@drawbridge/drawbridge-utils 0.0.160 → 0.0.161

package/dist/html.cjs

@@ -0,0 +1,29 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/html.js
+var html_exports = {};
+__export(html_exports, {
+  escapeHtml: () => escapeHtml
+});
+module.exports = __toCommonJS(html_exports);
+var escapeHtml = (value) => String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  escapeHtml
+});

package/dist/html.d.cts

@@ -0,0 +1,32 @@
+// Escaping for values interpolated into HTML we generate ourselves.
+//
+// ITS OWN MODULE, not part of sanitize.js, because that one imports the
+// ~120K-entry disposable-domain set at load — about 6MB of RSS its own comment
+// flags as a footprint to watch. Every email sync renders would have paid that
+// to escape five characters.
+//
+// Three copies of this existed before it moved here: drawbridge-api's oembed
+// route, drawbridge-sync's email renderer, and drawbridge-emails' signature
+// builder. They had already drifted — the signature builder escapes four
+// characters and omits the apostrophe. Harmless where it sits (its output lands
+// in text content and one double-quoted href, and the input is a config of our
+// own staff), which is exactly why it survived: a divergence with no symptom is
+// the kind that is only found by looking.
+
+// The five characters that change meaning inside markup. `&` FIRST — escaping it
+// after the others would re-escape the ampersands they just introduced and turn
+// `<` into `<`.
+//
+// Escapes for BOTH contexts, text and attribute, rather than asking callers
+// which they are in: `"` and `'` are inert in text content and cost nothing to
+// escape there, while getting it wrong in an attribute is an injection. A single
+// function nobody has to think about beats two that are chosen correctly most of
+// the time.
+const escapeHtml = ( value ) => String( value ?? '' )
+	.replace( /&/g, '&' )
+	.replace( /</g, '&lt;' )
+	.replace( />/g, '&gt;' )
+	.replace( /"/g, '&quot;' )
+	.replace( /'/g, '&#39;' );
+
+export { escapeHtml };

package/dist/html.d.ts

@@ -0,0 +1,32 @@
+// Escaping for values interpolated into HTML we generate ourselves.
+//
+// ITS OWN MODULE, not part of sanitize.js, because that one imports the
+// ~120K-entry disposable-domain set at load — about 6MB of RSS its own comment
+// flags as a footprint to watch. Every email sync renders would have paid that
+// to escape five characters.
+//
+// Three copies of this existed before it moved here: drawbridge-api's oembed
+// route, drawbridge-sync's email renderer, and drawbridge-emails' signature
+// builder. They had already drifted — the signature builder escapes four
+// characters and omits the apostrophe. Harmless where it sits (its output lands
+// in text content and one double-quoted href, and the input is a config of our
+// own staff), which is exactly why it survived: a divergence with no symptom is
+// the kind that is only found by looking.
+
+// The five characters that change meaning inside markup. `&` FIRST — escaping it
+// after the others would re-escape the ampersands they just introduced and turn
+// `<` into `<`.
+//
+// Escapes for BOTH contexts, text and attribute, rather than asking callers
+// which they are in: `"` and `'` are inert in text content and cost nothing to
+// escape there, while getting it wrong in an attribute is an injection. A single
+// function nobody has to think about beats two that are chosen correctly most of
+// the time.
+const escapeHtml = ( value ) => String( value ?? '' )
+	.replace( /&/g, '&' )
+	.replace( /</g, '&lt;' )
+	.replace( />/g, '&gt;' )
+	.replace( /"/g, '&quot;' )
+	.replace( /'/g, '&#39;' );
+
+export { escapeHtml };

package/dist/html.js

@@ -0,0 +1,5 @@
+// lib/html.js
+var escapeHtml = (value) => String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+export {
+  escapeHtml
+};

package/package.json

@@ -148,6 +148,11 @@
       "import": "./dist/twilio.js",
       "require": "./dist/twilio.cjs"
     },
+    "./html": {
+      "types": "./dist/html.d.ts",
+      "import": "./dist/html.js",
+      "require": "./dist/html.cjs"
+    },
     "./http": {
       "types": "./dist/http.d.ts",
       "import": "./dist/http.js",
@@ -221,5 +226,5 @@
     "prepublishOnly": ". \"$HOME/.nvm/nvm.sh\" && nvm use && tsup && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.160"
+  "version": "0.0.161"
 }