@godxjp/markdown 31.19.0 → 31.20.1

package/README.md

@@ -34,15 +34,16 @@ as `react-markdown` + `remark-gfm` + `rehype-sanitize`, which is what the apps r
 
 ## Host extension points
 
-| prop                                | use                                                                                    |
-| ----------------------------------- | -------------------------------------------------------------------------------------- |
-| `remarkPlugins`                     | Host markers (callouts, embeds). Their output is still sanitised.                      |
-| `schema`                            | `{ tagNames, attributes }` the markers need. Additive: it cannot widen the URL policy. |
-| `resolveUrl(url, key)`              | Map a host scheme (`asset:…`) to a real URL before the sanitiser judges it.            |
-| `headingId({ depth, text, index })` | Use server-assigned anchors instead of slugs.                                          |
-| `components`                        | Element overrides; a host `pre` replaces the Mermaid default.                          |
-| `rehypePlugins`                     | Run after the sanitiser — presentation only.                                           |
-| `mermaid={false}`                   | Keep ```mermaid fences as code.                                                        |
+| prop                                   | use                                                                                                                                                                                   |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `remarkPlugins`                        | Host markers (callouts, embeds). Their output is still sanitised.                                                                                                                     |
+| `schema`                               | `{ tagNames, attributes }` the markers need. A rule for an attribute the base already constrains is merged into it (`code` `className` + `math-inline`). Cannot widen the URL policy. |
+| `resolveUrl(url, key)`                 | Map a host scheme (`asset:…`) to a real URL before the sanitiser judges it.                                                                                                           |
+| `headingId({ depth, text, index })`    | Use server-assigned anchors instead of slugs.                                                                                                                                         |
+| `components`                           | Element overrides. Mermaid fences are drawn before a host `pre` is asked, so a host code renderer keeps Mermaid.                                                                      |
+| `rehypePlugins`                        | Run after the sanitiser — presentation only.                                                                                                                                          |
+| `mermaid={false}`                      | Keep ```mermaid fences as code (or hand them to the host `pre`).                                                                                                                      |
+| `allowedElements` / `unwrapDisallowed` | Narrow a body (an activity feed: `strong`, `em`, `del`, `code`). Only removes.                                                                                                        |
 
 ## Stored versions
 

package/dist/index.d.ts

@@ -49,7 +49,12 @@ type SchemaExtension = {
 /**
  * The schema plus a host's additions. ADDITIVE: an extension can allow a tag or an attribute, never
  * widen `protocols` or bring raw HTML back, so a consumer cannot loosen the URL policy by accident.
- * An attribute list for a tag the base already lists is appended to, not replaced.
+ *
+ * A rule for an attribute the base ALREADY constrains is MERGED into that rule (gh#1116): the
+ * sanitiser reads the first rule it finds for an attribute, so appending `["className",
+ * "math-inline"]` beside the default `["className", /^language-./]` was silently ignored and the
+ * formula class stripped. Merged, it is one rule allowing both. An attribute the base allows with
+ * no value constraint stays unconstrained.
  */
 declare function extendSchema(extension?: SchemaExtension): Options;
 /**
@@ -84,7 +89,10 @@ type MarkdownProps = {
     rehypePlugins?: PluggableList;
     /** Tags / attributes a host plugin needs. Additive; cannot widen the URL policy. */
     schema?: SchemaExtension;
-    /** Element overrides (react-markdown `components`). A host `pre` replaces the Mermaid default. */
+    /**
+     * Element overrides (react-markdown `components`). A host `pre` renders every fence EXCEPT
+     * ```mermaid, which is drawn through the gate first; `mermaid={false}` hands those to it too.
+     */
     components?: Components;
     /**
      * Resolves a host-specific URL (`asset:…`, a wiki link) to a real one. Runs before the sanitiser
@@ -93,8 +101,22 @@ type MarkdownProps = {
     resolveUrl?: (url: string, key: "href" | "src" | string) => string | undefined;
     /** Heading anchors: GitHub slugs by default; a host with server-side anchors supplies its own. */
     headingId?: HeadingIdResolver;
-    /** Render ```mermaid fences as gated diagrams (default true). `false` keeps them as code. */
+    /**
+     * Render ```mermaid fences as gated diagrams (default true). They are drawn BEFORE a host `pre`
+     * is consulted, so a host code renderer keeps Mermaid; `false` hands mermaid fences to the host
+     * `pre` (or plain code) as well (gh#1116).
+     */
     mermaid?: boolean;
+    /**
+     * NARROW the elements a body may produce — an activity feed that shows only inline formatting.
+     * react-markdown's own options, applied after the sanitiser; they can only remove, never allow
+     * what the schema strips (gh#1116).
+     */
+    allowedElements?: Options$1["allowedElements"];
+    disallowedElements?: Options$1["disallowedElements"];
+    allowElement?: Options$1["allowElement"];
+    /** With an element filter: keep a removed element's children (its text) instead of dropping it. */
+    unwrapDisallowed?: boolean;
 };
 /**
  * THE ONE RENDERER (gh#1108). GFM — tables, task lists, fenced code, autolinks, footnotes,
@@ -106,7 +128,7 @@ type MarkdownProps = {
  * Renders bare elements; the host wraps it (`<Prose>` from `@godxjp/ui/data-display`), so this
  * package carries no UI-kit dependency.
  */
-declare function Markdown({ children, remarkPlugins, rehypePlugins, schema, components, resolveUrl, headingId, mermaid, }: MarkdownProps): React.JSX.Element;
+declare function Markdown({ children, remarkPlugins, rehypePlugins, schema, components, resolveUrl, headingId, mermaid, allowedElements, disallowedElements, allowElement, unwrapDisallowed, }: MarkdownProps): React.JSX.Element;
 
 type MermaidSvgCheck = {
     ok: true;

package/dist/index.js

@@ -178,10 +178,23 @@ var markdownSchema = {
     h6: [...defaultSchema.attributes?.h6 ?? [], "id"]
   }
 };
+var ruleName = (rule) => Array.isArray(rule) ? rule[0] : rule;
 function extendSchema(extension = {}) {
   const attributes = { ...markdownSchema.attributes };
   for (const [tag, list] of Object.entries(extension.attributes ?? {})) {
-    attributes[tag] = [...attributes[tag] ?? [], ...list];
+    const merged = [...attributes[tag] ?? []];
+    for (const rule of list) {
+      const name = ruleName(rule);
+      const at = merged.findIndex((existing2) => ruleName(existing2) === name);
+      if (at === -1) {
+        merged.push(rule);
+        continue;
+      }
+      const existing = merged[at];
+      if (!Array.isArray(existing)) continue;
+      merged[at] = Array.isArray(rule) ? [name, ...existing.slice(1), ...rule.slice(1)] : rule;
+    }
+    attributes[tag] = merged;
   }
   return {
     ...markdownSchema,
@@ -238,19 +251,25 @@ function Markdown({
   components,
   resolveUrl,
   headingId,
-  mermaid = true
+  mermaid = true,
+  allowedElements,
+  disallowedElements,
+  allowElement,
+  unwrapDisallowed
 }) {
   const sanitizeSchema = React2.useMemo(() => extendSchema(schema), [schema]);
   const merged = React2.useMemo(() => {
-    const base = {};
-    if (mermaid) {
-      base.pre = ({ node, children: inner, ...props }) => {
-        const fence = fenceOf(node);
-        if (fence?.language === "mermaid") return /* @__PURE__ */ jsx2(MermaidDiagram, { source: fence.text });
-        return /* @__PURE__ */ jsx2("pre", { ...props, children: inner });
-      };
-    }
-    return { ...base, ...components };
+    if (!mermaid) return { ...components };
+    const HostPre = components?.pre;
+    const pre = (props) => {
+      const fence = fenceOf(props.node);
+      if (fence?.language === "mermaid") return /* @__PURE__ */ jsx2(MermaidDiagram, { source: fence.text });
+      if (HostPre)
+        return typeof HostPre === "string" ? React2.createElement(HostPre, props) : /* @__PURE__ */ jsx2(HostPre, { ...props });
+      const { node: _node, children: inner, ...rest } = props;
+      return /* @__PURE__ */ jsx2("pre", { ...rest, children: inner });
+    };
+    return { ...components, pre };
   }, [components, mermaid]);
   return /* @__PURE__ */ jsx2(
     ReactMarkdown,
@@ -264,6 +283,10 @@ function Markdown({
       ],
       urlTransform: safeUrl,
       components: merged,
+      allowedElements,
+      disallowedElements,
+      allowElement,
+      unwrapDisallowed,
       children
     }
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@godxjp/markdown",
-  "version": "31.19.0",
+  "version": "31.20.1",
   "description": "The one Markdown renderer for GoDX apps: GFM + heading anchors, one sanitiser schema, a shared fixture corpus, and Mermaid drawn only after its SVG passes a fail-closed gate.",
   "type": "module",
   "main": "./dist/index.js",