@immediately-run/sdk 0.33.0 → 0.35.0

package/dist/safeContent/mdastDeps.cjs

@@ -24,7 +24,10 @@ __export(mdastDeps_exports, {
   gfm: () => gfm,
   gfmFromMarkdown: () => gfmFromMarkdown,
   mdxJsx: () => mdxJsx,
-  mdxJsxFromMarkdown: () => mdxJsxFromMarkdown
+  mdxJsxFromMarkdown: () => mdxJsxFromMarkdown,
+  remarkAdmonitions: () => remarkAdmonitions_default,
+  remarkHeadingAnchors: () => remarkHeadingAnchors_default,
+  remarkWikiLinks: () => remarkWikiLinks_default
 });
 module.exports = __toCommonJS(mdastDeps_exports);
 
@@ -10695,3 +10698,185 @@ function gfmFromMarkdown() {
     gfmTaskListItemFromMarkdown()
   ];
 }
+
+// node_modules/@immediately-run/mdx-plugins/dist/index.js
+function textSlug(text4) {
+  return text4.trim().toLowerCase().replace(/[^\w\s-]/g, "").replace(/\s+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+}
+var LEADING_TOKEN = /^([A-Za-z0-9]+(?:\.[A-Za-z0-9]+)*)/;
+function sectionId(text4) {
+  const m = text4.trim().match(LEADING_TOKEN);
+  if (!m) return null;
+  const token = m[1];
+  const firstComponent = token.split(".")[0];
+  const sectionLike = /\d/.test(firstComponent) || /^[A-Za-z]\./.test(token);
+  if (!sectionLike) return null;
+  return "sec-" + token.toLowerCase().replace(/\./g, "-");
+}
+function headingText(node2) {
+  let out = "";
+  const visit2 = (n) => {
+    if (n.type === "text" || n.type === "inlineCode") {
+      out += n.value ?? "";
+      return;
+    }
+    if (n.type === "mdxJsxTextElement" || n.type === "mdxTextExpression") return;
+    if (Array.isArray(n.children)) n.children.forEach(visit2);
+  };
+  if (Array.isArray(node2.children)) node2.children.forEach(visit2);
+  return out;
+}
+function hasAuthorId(node2) {
+  const id = node2.data?.hProperties?.id;
+  return typeof id === "string" && id.length > 0;
+}
+function anchorNode(id) {
+  return {
+    type: "mdxJsxTextElement",
+    name: "HeadingAnchor",
+    attributes: [{ type: "mdxJsxAttribute", name: "id", value: id }],
+    children: []
+  };
+}
+var remarkHeadingAnchors = (options = {}) => (tree) => {
+  const sectionEnabled = options.sectionIds !== false;
+  const seen = /* @__PURE__ */ new Map();
+  const root = tree;
+  const children = root.children;
+  if (!Array.isArray(children)) return;
+  for (const node2 of children) {
+    if (node2.type !== "heading") continue;
+    if (hasAuthorId(node2)) continue;
+    const text4 = headingText(node2);
+    const slug = textSlug(text4);
+    const sec = sectionEnabled ? sectionId(text4) : null;
+    let baseId = sec ?? slug ?? "";
+    if (baseId === "") baseId = "section";
+    const n = seen.get(baseId) ?? 0;
+    seen.set(baseId, n + 1);
+    const id = n === 0 ? baseId : `${baseId}-${n}`;
+    const hProperties = (node2.data ?? (node2.data = {})).hProperties ?? (node2.data.hProperties = {});
+    hProperties.id = id;
+    if (sec && slug && slug !== id) hProperties["data-slug"] = slug;
+    node2.children = [anchorNode(id), ...node2.children ?? []];
+  }
+};
+var remarkHeadingAnchors_default = remarkHeadingAnchors;
+var WIKILINK = /\[\[([^[\]]+)\]\]/g;
+function toWikiLink(inner) {
+  const pipe = inner.indexOf("|");
+  let target;
+  let label;
+  if (pipe === -1) {
+    target = inner.trim();
+  } else {
+    label = inner.slice(0, pipe).trim();
+    target = inner.slice(pipe + 1).trim();
+  }
+  if (target === "") return null;
+  const attributes = [
+    { type: "mdxJsxAttribute", name: "target", value: target }
+  ];
+  if (label) {
+    attributes.push({ type: "mdxJsxAttribute", name: "label", value: label });
+  }
+  return {
+    type: "mdxJsxTextElement",
+    // inline (phrasing) — a wiki-link sits in a paragraph
+    name: "WikiLink",
+    attributes,
+    children: []
+  };
+}
+function splitTextNode(node2) {
+  const value = node2.value;
+  if (typeof value !== "string" || value.indexOf("[[") === -1) return null;
+  const out = [];
+  let lastIndex = 0;
+  let produced = false;
+  WIKILINK.lastIndex = 0;
+  let match;
+  while ((match = WIKILINK.exec(value)) !== null) {
+    const wl = toWikiLink(match[1]);
+    if (!wl) continue;
+    if (match.index > lastIndex) {
+      out.push({ type: "text", value: value.slice(lastIndex, match.index) });
+    }
+    out.push(wl);
+    lastIndex = match.index + match[0].length;
+    produced = true;
+  }
+  if (!produced) return null;
+  if (lastIndex < value.length) {
+    out.push({ type: "text", value: value.slice(lastIndex) });
+  }
+  return out;
+}
+function walk(node2) {
+  const children = node2.children;
+  if (!Array.isArray(children)) return;
+  for (let i = 0; i < children.length; i++) {
+    const child = children[i];
+    if (child.type === "text") {
+      const replacement = splitTextNode(child);
+      if (replacement) {
+        children.splice(i, 1, ...replacement);
+        i += replacement.length - 1;
+      }
+      continue;
+    }
+    walk(child);
+  }
+}
+var remarkWikiLinks = () => (tree) => {
+  walk(tree);
+};
+var remarkWikiLinks_default = remarkWikiLinks;
+var MARKER = /^\[!(NOTE|TIP|IMPORTANT|WARNING|CAUTION)\][ \t]*(\r?\n|$)/i;
+function toAdmonition(blockquote) {
+  const firstBlock = blockquote.children?.[0];
+  if (!firstBlock || firstBlock.type !== "paragraph") return null;
+  const inlines = firstBlock.children;
+  const firstInline = inlines?.[0];
+  if (!firstInline || firstInline.type !== "text" || typeof firstInline.value !== "string") {
+    return null;
+  }
+  const match = MARKER.exec(firstInline.value);
+  if (!match) return null;
+  const consumedNewline = match[2] !== "";
+  if (!consumedNewline && (inlines?.length ?? 0) > 1) return null;
+  const type = match[1].toLowerCase();
+  const rest = firstInline.value.slice(match[0].length);
+  if (rest.length === 0) {
+    inlines.shift();
+    if (inlines.length === 0) blockquote.children.shift();
+  } else {
+    firstInline.value = rest;
+  }
+  return {
+    type: "mdxJsxFlowElement",
+    name: "Admonition",
+    attributes: [{ type: "mdxJsxAttribute", name: "type", value: type }],
+    children: blockquote.children ?? []
+  };
+}
+function walk2(node2) {
+  const children = node2.children;
+  if (!Array.isArray(children)) return;
+  for (let i = 0; i < children.length; i++) {
+    const child = children[i];
+    if (child.type === "blockquote") {
+      const converted = toAdmonition(child);
+      if (converted) {
+        children[i] = converted;
+        walk2(converted);
+        continue;
+      }
+    }
+    walk2(child);
+  }
+}
+var remarkAdmonitions = () => (tree) => {
+  walk2(tree);
+};
+var remarkAdmonitions_default = remarkAdmonitions;

package/dist/safeContent/mdastDeps.js

@@ -10671,10 +10671,195 @@ function gfmFromMarkdown() {
     gfmTaskListItemFromMarkdown()
   ];
 }
+
+// node_modules/@immediately-run/mdx-plugins/dist/index.js
+function textSlug(text4) {
+  return text4.trim().toLowerCase().replace(/[^\w\s-]/g, "").replace(/\s+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+}
+var LEADING_TOKEN = /^([A-Za-z0-9]+(?:\.[A-Za-z0-9]+)*)/;
+function sectionId(text4) {
+  const m = text4.trim().match(LEADING_TOKEN);
+  if (!m) return null;
+  const token = m[1];
+  const firstComponent = token.split(".")[0];
+  const sectionLike = /\d/.test(firstComponent) || /^[A-Za-z]\./.test(token);
+  if (!sectionLike) return null;
+  return "sec-" + token.toLowerCase().replace(/\./g, "-");
+}
+function headingText(node2) {
+  let out = "";
+  const visit2 = (n) => {
+    if (n.type === "text" || n.type === "inlineCode") {
+      out += n.value ?? "";
+      return;
+    }
+    if (n.type === "mdxJsxTextElement" || n.type === "mdxTextExpression") return;
+    if (Array.isArray(n.children)) n.children.forEach(visit2);
+  };
+  if (Array.isArray(node2.children)) node2.children.forEach(visit2);
+  return out;
+}
+function hasAuthorId(node2) {
+  const id = node2.data?.hProperties?.id;
+  return typeof id === "string" && id.length > 0;
+}
+function anchorNode(id) {
+  return {
+    type: "mdxJsxTextElement",
+    name: "HeadingAnchor",
+    attributes: [{ type: "mdxJsxAttribute", name: "id", value: id }],
+    children: []
+  };
+}
+var remarkHeadingAnchors = (options = {}) => (tree) => {
+  const sectionEnabled = options.sectionIds !== false;
+  const seen = /* @__PURE__ */ new Map();
+  const root = tree;
+  const children = root.children;
+  if (!Array.isArray(children)) return;
+  for (const node2 of children) {
+    if (node2.type !== "heading") continue;
+    if (hasAuthorId(node2)) continue;
+    const text4 = headingText(node2);
+    const slug = textSlug(text4);
+    const sec = sectionEnabled ? sectionId(text4) : null;
+    let baseId = sec ?? slug ?? "";
+    if (baseId === "") baseId = "section";
+    const n = seen.get(baseId) ?? 0;
+    seen.set(baseId, n + 1);
+    const id = n === 0 ? baseId : `${baseId}-${n}`;
+    const hProperties = (node2.data ?? (node2.data = {})).hProperties ?? (node2.data.hProperties = {});
+    hProperties.id = id;
+    if (sec && slug && slug !== id) hProperties["data-slug"] = slug;
+    node2.children = [anchorNode(id), ...node2.children ?? []];
+  }
+};
+var remarkHeadingAnchors_default = remarkHeadingAnchors;
+var WIKILINK = /\[\[([^[\]]+)\]\]/g;
+function toWikiLink(inner) {
+  const pipe = inner.indexOf("|");
+  let target;
+  let label;
+  if (pipe === -1) {
+    target = inner.trim();
+  } else {
+    label = inner.slice(0, pipe).trim();
+    target = inner.slice(pipe + 1).trim();
+  }
+  if (target === "") return null;
+  const attributes = [
+    { type: "mdxJsxAttribute", name: "target", value: target }
+  ];
+  if (label) {
+    attributes.push({ type: "mdxJsxAttribute", name: "label", value: label });
+  }
+  return {
+    type: "mdxJsxTextElement",
+    // inline (phrasing) — a wiki-link sits in a paragraph
+    name: "WikiLink",
+    attributes,
+    children: []
+  };
+}
+function splitTextNode(node2) {
+  const value = node2.value;
+  if (typeof value !== "string" || value.indexOf("[[") === -1) return null;
+  const out = [];
+  let lastIndex = 0;
+  let produced = false;
+  WIKILINK.lastIndex = 0;
+  let match;
+  while ((match = WIKILINK.exec(value)) !== null) {
+    const wl = toWikiLink(match[1]);
+    if (!wl) continue;
+    if (match.index > lastIndex) {
+      out.push({ type: "text", value: value.slice(lastIndex, match.index) });
+    }
+    out.push(wl);
+    lastIndex = match.index + match[0].length;
+    produced = true;
+  }
+  if (!produced) return null;
+  if (lastIndex < value.length) {
+    out.push({ type: "text", value: value.slice(lastIndex) });
+  }
+  return out;
+}
+function walk(node2) {
+  const children = node2.children;
+  if (!Array.isArray(children)) return;
+  for (let i = 0; i < children.length; i++) {
+    const child = children[i];
+    if (child.type === "text") {
+      const replacement = splitTextNode(child);
+      if (replacement) {
+        children.splice(i, 1, ...replacement);
+        i += replacement.length - 1;
+      }
+      continue;
+    }
+    walk(child);
+  }
+}
+var remarkWikiLinks = () => (tree) => {
+  walk(tree);
+};
+var remarkWikiLinks_default = remarkWikiLinks;
+var MARKER = /^\[!(NOTE|TIP|IMPORTANT|WARNING|CAUTION)\][ \t]*(\r?\n|$)/i;
+function toAdmonition(blockquote) {
+  const firstBlock = blockquote.children?.[0];
+  if (!firstBlock || firstBlock.type !== "paragraph") return null;
+  const inlines = firstBlock.children;
+  const firstInline = inlines?.[0];
+  if (!firstInline || firstInline.type !== "text" || typeof firstInline.value !== "string") {
+    return null;
+  }
+  const match = MARKER.exec(firstInline.value);
+  if (!match) return null;
+  const consumedNewline = match[2] !== "";
+  if (!consumedNewline && (inlines?.length ?? 0) > 1) return null;
+  const type = match[1].toLowerCase();
+  const rest = firstInline.value.slice(match[0].length);
+  if (rest.length === 0) {
+    inlines.shift();
+    if (inlines.length === 0) blockquote.children.shift();
+  } else {
+    firstInline.value = rest;
+  }
+  return {
+    type: "mdxJsxFlowElement",
+    name: "Admonition",
+    attributes: [{ type: "mdxJsxAttribute", name: "type", value: type }],
+    children: blockquote.children ?? []
+  };
+}
+function walk2(node2) {
+  const children = node2.children;
+  if (!Array.isArray(children)) return;
+  for (let i = 0; i < children.length; i++) {
+    const child = children[i];
+    if (child.type === "blockquote") {
+      const converted = toAdmonition(child);
+      if (converted) {
+        children[i] = converted;
+        walk2(converted);
+        continue;
+      }
+    }
+    walk2(child);
+  }
+}
+var remarkAdmonitions = () => (tree) => {
+  walk2(tree);
+};
+var remarkAdmonitions_default = remarkAdmonitions;
 export {
   fromMarkdown,
   gfm,
   gfmFromMarkdown,
   mdxJsx,
-  mdxJsxFromMarkdown
+  mdxJsxFromMarkdown,
+  remarkAdmonitions_default as remarkAdmonitions,
+  remarkHeadingAnchors_default as remarkHeadingAnchors,
+  remarkWikiLinks_default as remarkWikiLinks
 };

package/dist/safeContent/parseSafeMdast.cjs

@@ -31,27 +31,36 @@ __export(parseSafeMdast_exports, {
   parseSafeMdast: () => parseSafeMdast
 });
 module.exports = __toCommonJS(parseSafeMdast_exports);
-var import_mdx_plugins = require("@immediately-run/mdx-plugins");
 let depsPromise = null;
 function loadDeps() {
   if (!depsPromise) {
-    depsPromise = import("./mdastDeps").then(
-      (m) => ({
-        fromMarkdown: m.fromMarkdown,
-        mdxJsx: m.mdxJsx,
-        mdxJsxFromMarkdown: m.mdxJsxFromMarkdown,
-        gfm: m.gfm,
-        gfmFromMarkdown: m.gfmFromMarkdown
-      })
-    );
+    depsPromise = import("./mdastDeps").then((m) => {
+      const d = m;
+      return {
+        fromMarkdown: d.fromMarkdown,
+        mdxJsx: d.mdxJsx,
+        mdxJsxFromMarkdown: d.mdxJsxFromMarkdown,
+        gfm: d.gfm,
+        gfmFromMarkdown: d.gfmFromMarkdown,
+        remarkAdmonitions: d.remarkAdmonitions,
+        remarkWikiLinks: d.remarkWikiLinks,
+        remarkHeadingAnchors: d.remarkHeadingAnchors
+      };
+    });
   }
   return depsPromise;
 }
-const admonitions = import_mdx_plugins.remarkAdmonitions;
-const wikiLinks = import_mdx_plugins.remarkWikiLinks;
-const headingAnchors = import_mdx_plugins.remarkHeadingAnchors;
 async function parseSafeMdast(source, options = {}) {
-  const { fromMarkdown, mdxJsx, mdxJsxFromMarkdown, gfm, gfmFromMarkdown } = await loadDeps();
+  const {
+    fromMarkdown,
+    mdxJsx,
+    mdxJsxFromMarkdown,
+    gfm,
+    gfmFromMarkdown,
+    remarkAdmonitions,
+    remarkWikiLinks,
+    remarkHeadingAnchors
+  } = await loadDeps();
   const tree = fromMarkdown(source, {
     // `mdxJsx()` WITHOUT an acorn option → JSX tags + literal attrs; expressions are
     // raw strings, never estree. The mdx *expression* extension is intentionally
@@ -59,9 +68,9 @@ async function parseSafeMdast(source, options = {}) {
     extensions: [mdxJsx(), gfm()],
     mdastExtensions: [mdxJsxFromMarkdown(), gfmFromMarkdown()]
   });
-  admonitions()(tree);
-  wikiLinks()(tree);
-  headingAnchors({ sectionIds: options.sectionIds !== false })(tree);
+  remarkAdmonitions()(tree);
+  remarkWikiLinks()(tree);
+  remarkHeadingAnchors({ sectionIds: options.sectionIds !== false })(tree);
   return tree;
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/safeContent/parseSafeMdast.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/safeContent/parseSafeMdast.ts"],"sourcesContent":["// The no-acorn parse pipeline for the safe content renderer (TRUST_MODES_SPEC §5.1,\n// empirically verified 2026-07-07 against `@mdx-js/mdx` v3 / `micromark-extension-\n// mdx-jsx`). This is the load-bearing half of the fail-safe: `<Component/>` syntax\n// parses to an element node with **literal** attributes, and every expression\n// (`n={1+1}`, `f={fetch(\"/x\")}`, `{...spread}`) is captured as an **inert raw string\n// with no estree** — because we pass **NO acorn option** to `micromark-extension-mdx-\n// jsx`. There is therefore no evaluator anywhere in the pipeline (fail-safe), unlike\n// `@mdx-js/mdx`'s `compile({format:'mdx'})` which always wires acorn.\n//\n// The §5.1 residual guarantees are also here: the expression micromark extension is\n// **not** enabled (body `{…}` stays literal text), and **no `rehype-raw`** / raw-HTML\n// passthrough exists — raw HTML blocks arrive as inert `html` mdast nodes the renderer\n// prints as text, never injected.\n//\n// `micromark`/`mdast` are ESM-only. They are loaded with a memoised dynamic `import()`\n// (the transpiler's `compile.ts` pattern) so this module sits in the package's CJS\n// build too — a CJS consumer that never renders untrusted content never `require()`s\n// an ESM-only package, and one that does gets it via Node's ESM-from-CJS import. The\n// dynamic load changes only *when* the deps resolve, never the produced tree.\n//\n// The dynamic import targets `./mdastDeps` — a SINGLE self-contained artifact that a\n// dedicated build pass (`scripts/build-safecontent-deps.mjs`) inlines the whole ESM tree\n// into (see `mdastDeps.ts` for the WHY). This keeps the `import()` boundary (a consumer\n// that never renders safe content never loads the ~300KB parser) while making the imported\n// target one already-bundled file the immediately.run sandbox resolver can fetch without\n// walking the unified/micromark conditional-exports tree — the R3-213 on-host packaging\n// gap. In jest/ts-jest and the e2e bundle the same `./mdastDeps` resolves to the source\n// re-export module, which pulls the real deps from node_modules; the produced tree is\n// identical either way.\n\nimport {\n  remarkAdmonitions,\n  remarkWikiLinks,\n  remarkHeadingAnchors,\n  type HeadingAnchorOptions,\n} from '@immediately-run/mdx-plugins';\n\n// A minimal structural mdast shape — we deliberately avoid a type dependency on the\n// ESM-only `mdast`/`unist` packages (which would break the CJS build's type surface).\nexport interface SafeMdastNode {\n  type: string;\n  value?: string;\n  name?: string | null;\n  url?: string;\n  alt?: string | null;\n  title?: string | null;\n  depth?: number;\n  ordered?: boolean;\n  lang?: string | null;\n  children?: SafeMdastNode[];\n  attributes?: SafeMdxAttribute[];\n  [key: string]: unknown;\n}\n\nexport interface SafeMdxAttribute {\n  type: 'mdxJsxAttribute' | 'mdxJsxExpressionAttribute';\n  name?: string;\n  // A literal attribute carries a string; an expression attribute carries an\n  // `mdxJsxAttributeValueExpression` object (a raw string, NO estree) or a string.\n  value?: string | { type: string; value?: string } | null;\n}\n\ntype Deps = {\n  fromMarkdown: (\n    value: string,\n    options: { extensions: unknown[]; mdastExtensions: unknown[] },\n  ) => SafeMdastNode;\n  mdxJsx: () => unknown;\n  mdxJsxFromMarkdown: () => unknown;\n  gfm: () => unknown;\n  gfmFromMarkdown: () => unknown;\n};\n\nlet depsPromise: Promise<Deps> | null = null;\n\nfunction loadDeps(): Promise<Deps> {\n  if (!depsPromise) {\n    // ONE dynamic import of the pre-inlined artifact (see the header note + `mdastDeps.ts`)\n    // instead of five bare ESM specifiers the sandbox resolver can't walk on-host.\n    depsPromise = import('./mdastDeps').then(\n      (m) =>\n        ({\n          fromMarkdown: (m as unknown as { fromMarkdown: Deps['fromMarkdown'] }).fromMarkdown,\n          mdxJsx: (m as unknown as { mdxJsx: Deps['mdxJsx'] }).mdxJsx,\n          mdxJsxFromMarkdown: (m as unknown as { mdxJsxFromMarkdown: Deps['mdxJsxFromMarkdown'] })\n            .mdxJsxFromMarkdown,\n          gfm: (m as unknown as { gfm: Deps['gfm'] }).gfm,\n          gfmFromMarkdown: (m as unknown as { gfmFromMarkdown: Deps['gfmFromMarkdown'] }).gfmFromMarkdown,\n        }) as Deps,\n    );\n  }\n  return depsPromise;\n}\n\nexport interface ParseSafeMdastOptions {\n  /** `false` ⇒ headings use plain text-slug ids (the R3-186 base; no `sec-…` section\n   *  ids, no `data-slug`) — the `sectionIds:false` frontmatter opt-out, matching the\n   *  compiled path. Default (undefined/true) ⇒ section-like headings get `sec-…` ids\n   *  (R3-211). */\n  sectionIds?: boolean;\n}\n\n// The three kernel remark plugins for the MDX *safe subset* — the SAME source the\n// compiled path (transpiler `compileMdx`) runs, imported from the shared package so the\n// two render standards can't drift (TRUST_MODES_SPEC §5 / §5.1, R3-213). They are pure\n// mdast transforms: `(options?) => (tree) => void`. `unified`'s `Plugin` type widens the\n// return to `Transformer | void`; here we invoke the transformer directly on the tree,\n// so narrow it to a plain in-place mutator.\ntype MdastMutator = (tree: SafeMdastNode) => void;\nconst admonitions = remarkAdmonitions as unknown as () => MdastMutator;\nconst wikiLinks = remarkWikiLinks as unknown as () => MdastMutator;\nconst headingAnchors = remarkHeadingAnchors as unknown as (o?: HeadingAnchorOptions) => MdastMutator;\n\n/**\n * Parse untrusted Markdown/MDX-syntax source to an mdast tree with **no evaluator in\n * the pipeline**: JSX-as-data (no acorn), GFM on, the expression extension OFF, no\n * raw-HTML re-parse. The returned tree is safe to hand to `renderMdast` — expression\n * attributes are inert strings and raw HTML is inert `html` nodes.\n *\n * After the no-acorn parse it runs the SHARED kernel remark plugins — in the SAME order\n * as the compiled path's `compile.ts` (admonitions §12 → wiki-links §13 → heading/section\n * anchors §15/R3-211; GFM is already applied via the micromark extension above) — so the\n * safe subset renders identically in both standards. The plugins only emit element nodes\n * with LITERAL attributes and set `data.hProperties.id` on headings; they add no evaluator\n * and no acorn, preserving the §5.1 fail-safe.\n */\nexport async function parseSafeMdast(\n  source: string,\n  options: ParseSafeMdastOptions = {},\n): Promise<SafeMdastNode> {\n  const { fromMarkdown, mdxJsx, mdxJsxFromMarkdown, gfm, gfmFromMarkdown } = await loadDeps();\n  const tree = fromMarkdown(source, {\n    // `mdxJsx()` WITHOUT an acorn option → JSX tags + literal attrs; expressions are\n    // raw strings, never estree. The mdx *expression* extension is intentionally\n    // absent, so `{…}` in body text stays literal. GFM for tables/task-lists.\n    extensions: [mdxJsx(), gfm()],\n    mdastExtensions: [mdxJsxFromMarkdown(), gfmFromMarkdown()],\n  });\n  admonitions()(tree);\n  wikiLinks()(tree);\n  headingAnchors({ sectionIds: options.sectionIds !== false })(tree);\n  return tree;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BA,yBAKO;AAsCP,IAAI,cAAoC;AAExC,SAAS,WAA0B;AACjC,MAAI,CAAC,aAAa;AAGhB,kBAAc,OAAO,aAAa,EAAE;AAAA,MAClC,CAAC,OACE;AAAA,QACC,cAAe,EAAwD;AAAA,QACvE,QAAS,EAA4C;AAAA,QACrD,oBAAqB,EAClB;AAAA,QACH,KAAM,EAAsC;AAAA,QAC5C,iBAAkB,EAA8D;AAAA,MAClF;AAAA,IACJ;AAAA,EACF;AACA,SAAO;AACT;AAiBA,MAAM,cAAc;AACpB,MAAM,YAAY;AAClB,MAAM,iBAAiB;AAevB,eAAsB,eACpB,QACA,UAAiC,CAAC,GACV;AACxB,QAAM,EAAE,cAAc,QAAQ,oBAAoB,KAAK,gBAAgB,IAAI,MAAM,SAAS;AAC1F,QAAM,OAAO,aAAa,QAAQ;AAAA;AAAA;AAAA;AAAA,IAIhC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;AAAA,IAC5B,iBAAiB,CAAC,mBAAmB,GAAG,gBAAgB,CAAC;AAAA,EAC3D,CAAC;AACD,cAAY,EAAE,IAAI;AAClB,YAAU,EAAE,IAAI;AAChB,iBAAe,EAAE,YAAY,QAAQ,eAAe,MAAM,CAAC,EAAE,IAAI;AACjE,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/safeContent/parseSafeMdast.ts"],"sourcesContent":["// The no-acorn parse pipeline for the safe content renderer (TRUST_MODES_SPEC §5.1,\n// empirically verified 2026-07-07 against `@mdx-js/mdx` v3 / `micromark-extension-\n// mdx-jsx`). This is the load-bearing half of the fail-safe: `<Component/>` syntax\n// parses to an element node with **literal** attributes, and every expression\n// (`n={1+1}`, `f={fetch(\"/x\")}`, `{...spread}`) is captured as an **inert raw string\n// with no estree** — because we pass **NO acorn option** to `micromark-extension-mdx-\n// jsx`. There is therefore no evaluator anywhere in the pipeline (fail-safe), unlike\n// `@mdx-js/mdx`'s `compile({format:'mdx'})` which always wires acorn.\n//\n// The §5.1 residual guarantees are also here: the expression micromark extension is\n// **not** enabled (body `{…}` stays literal text), and **no `rehype-raw`** / raw-HTML\n// passthrough exists — raw HTML blocks arrive as inert `html` mdast nodes the renderer\n// prints as text, never injected.\n//\n// `micromark`/`mdast` are ESM-only. They are loaded with a memoised dynamic `import()`\n// (the transpiler's `compile.ts` pattern) so this module sits in the package's CJS\n// build too — a CJS consumer that never renders untrusted content never `require()`s\n// an ESM-only package, and one that does gets it via Node's ESM-from-CJS import. The\n// dynamic load changes only *when* the deps resolve, never the produced tree.\n//\n// The dynamic import targets `./mdastDeps` — a SINGLE self-contained artifact that a\n// dedicated build pass (`scripts/build-safecontent-deps.mjs`) inlines the whole ESM tree\n// into (see `mdastDeps.ts` for the WHY). This keeps the `import()` boundary (a consumer\n// that never renders safe content never loads the ~300KB parser) while making the imported\n// target one already-bundled file the immediately.run sandbox resolver can fetch without\n// walking the unified/micromark conditional-exports tree — the R3-213 on-host packaging\n// gap. In jest/ts-jest and the e2e bundle the same `./mdastDeps` resolves to the source\n// re-export module, which pulls the real deps from node_modules; the produced tree is\n// identical either way.\n\n// Type-only — the plugin VALUES are re-exported from (and inlined by) `./mdastDeps`; a\n// value import here would put a bare `@immediately-run/mdx-plugins` specifier in the dist\n// the sandbox resolver can't resolve on-host. `import type` is fully erased at build.\nimport type { HeadingAnchorOptions } from '@immediately-run/mdx-plugins';\n\n// A minimal structural mdast shape — we deliberately avoid a type dependency on the\n// ESM-only `mdast`/`unist` packages (which would break the CJS build's type surface).\nexport interface SafeMdastNode {\n  type: string;\n  value?: string;\n  name?: string | null;\n  url?: string;\n  alt?: string | null;\n  title?: string | null;\n  depth?: number;\n  ordered?: boolean;\n  lang?: string | null;\n  children?: SafeMdastNode[];\n  attributes?: SafeMdxAttribute[];\n  [key: string]: unknown;\n}\n\nexport interface SafeMdxAttribute {\n  type: 'mdxJsxAttribute' | 'mdxJsxExpressionAttribute';\n  name?: string;\n  // A literal attribute carries a string; an expression attribute carries an\n  // `mdxJsxAttributeValueExpression` object (a raw string, NO estree) or a string.\n  value?: string | { type: string; value?: string } | null;\n}\n\n// `unified`'s `Plugin` type widens the return to `Transformer | void`; the safe path\n// invokes each transformer directly on the tree, so narrow it to a plain in-place mutator.\ntype MdastMutator = (tree: SafeMdastNode) => void;\n\ntype Deps = {\n  fromMarkdown: (\n    value: string,\n    options: { extensions: unknown[]; mdastExtensions: unknown[] },\n  ) => SafeMdastNode;\n  mdxJsx: () => unknown;\n  mdxJsxFromMarkdown: () => unknown;\n  gfm: () => unknown;\n  gfmFromMarkdown: () => unknown;\n  // The three shared kernel remark plugins, also inlined into `./mdastDeps` (see there).\n  remarkAdmonitions: () => MdastMutator;\n  remarkWikiLinks: () => MdastMutator;\n  remarkHeadingAnchors: (o?: HeadingAnchorOptions) => MdastMutator;\n};\n\nlet depsPromise: Promise<Deps> | null = null;\n\nfunction loadDeps(): Promise<Deps> {\n  if (!depsPromise) {\n    // ONE dynamic import of the pre-inlined artifact (see the header note + `mdastDeps.ts`)\n    // — the five ESM parser packages AND the shared remark plugins, none of which the\n    // sandbox resolver can walk/resolve as bare specifiers on-host.\n    depsPromise = import('./mdastDeps').then((m) => {\n      const d = m as unknown as Deps;\n      return {\n        fromMarkdown: d.fromMarkdown,\n        mdxJsx: d.mdxJsx,\n        mdxJsxFromMarkdown: d.mdxJsxFromMarkdown,\n        gfm: d.gfm,\n        gfmFromMarkdown: d.gfmFromMarkdown,\n        remarkAdmonitions: d.remarkAdmonitions,\n        remarkWikiLinks: d.remarkWikiLinks,\n        remarkHeadingAnchors: d.remarkHeadingAnchors,\n      } as Deps;\n    });\n  }\n  return depsPromise;\n}\n\nexport interface ParseSafeMdastOptions {\n  /** `false` ⇒ headings use plain text-slug ids (the R3-186 base; no `sec-…` section\n   *  ids, no `data-slug`) — the `sectionIds:false` frontmatter opt-out, matching the\n   *  compiled path. Default (undefined/true) ⇒ section-like headings get `sec-…` ids\n   *  (R3-211). */\n  sectionIds?: boolean;\n}\n\n/**\n * Parse untrusted Markdown/MDX-syntax source to an mdast tree with **no evaluator in\n * the pipeline**: JSX-as-data (no acorn), GFM on, the expression extension OFF, no\n * raw-HTML re-parse. The returned tree is safe to hand to `renderMdast` — expression\n * attributes are inert strings and raw HTML is inert `html` nodes.\n *\n * After the no-acorn parse it runs the SHARED kernel remark plugins — in the SAME order\n * as the compiled path's `compile.ts` (admonitions §12 → wiki-links §13 → heading/section\n * anchors §15/R3-211; GFM is already applied via the micromark extension above) — so the\n * safe subset renders identically in both standards. The plugins only emit element nodes\n * with LITERAL attributes and set `data.hProperties.id` on headings; they add no evaluator\n * and no acorn, preserving the §5.1 fail-safe.\n */\nexport async function parseSafeMdast(\n  source: string,\n  options: ParseSafeMdastOptions = {},\n): Promise<SafeMdastNode> {\n  const {\n    fromMarkdown,\n    mdxJsx,\n    mdxJsxFromMarkdown,\n    gfm,\n    gfmFromMarkdown,\n    remarkAdmonitions,\n    remarkWikiLinks,\n    remarkHeadingAnchors,\n  } = await loadDeps();\n  const tree = fromMarkdown(source, {\n    // `mdxJsx()` WITHOUT an acorn option → JSX tags + literal attrs; expressions are\n    // raw strings, never estree. The mdx *expression* extension is intentionally\n    // absent, so `{…}` in body text stays literal. GFM for tables/task-lists.\n    extensions: [mdxJsx(), gfm()],\n    mdastExtensions: [mdxJsxFromMarkdown(), gfmFromMarkdown()],\n  });\n  // The SHARED kernel remark plugins, in the SAME order as the compiled path's `compile.ts`\n  // (admonitions §12 → wiki-links §13 → heading/section anchors §15/R3-211).\n  remarkAdmonitions()(tree);\n  remarkWikiLinks()(tree);\n  remarkHeadingAnchors({ sectionIds: options.sectionIds !== false })(tree);\n  return tree;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA+EA,IAAI,cAAoC;AAExC,SAAS,WAA0B;AACjC,MAAI,CAAC,aAAa;AAIhB,kBAAc,OAAO,aAAa,EAAE,KAAK,CAAC,MAAM;AAC9C,YAAM,IAAI;AACV,aAAO;AAAA,QACL,cAAc,EAAE;AAAA,QAChB,QAAQ,EAAE;AAAA,QACV,oBAAoB,EAAE;AAAA,QACtB,KAAK,EAAE;AAAA,QACP,iBAAiB,EAAE;AAAA,QACnB,mBAAmB,EAAE;AAAA,QACrB,iBAAiB,EAAE;AAAA,QACnB,sBAAsB,EAAE;AAAA,MAC1B;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAuBA,eAAsB,eACpB,QACA,UAAiC,CAAC,GACV;AACxB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,SAAS;AACnB,QAAM,OAAO,aAAa,QAAQ;AAAA;AAAA;AAAA;AAAA,IAIhC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;AAAA,IAC5B,iBAAiB,CAAC,mBAAmB,GAAG,gBAAgB,CAAC;AAAA,EAC3D,CAAC;AAGD,oBAAkB,EAAE,IAAI;AACxB,kBAAgB,EAAE,IAAI;AACtB,uBAAqB,EAAE,YAAY,QAAQ,eAAe,MAAM,CAAC,EAAE,IAAI;AACvE,SAAO;AACT;","names":[]}

package/dist/safeContent/parseSafeMdast.js

@@ -1,28 +1,34 @@
-import {
-  remarkAdmonitions,
-  remarkWikiLinks,
-  remarkHeadingAnchors
-} from "@immediately-run/mdx-plugins";
+import "../chunk-VHAA22YE.js";
 let depsPromise = null;
 function loadDeps() {
   if (!depsPromise) {
-    depsPromise = import("./mdastDeps").then(
-      (m) => ({
-        fromMarkdown: m.fromMarkdown,
-        mdxJsx: m.mdxJsx,
-        mdxJsxFromMarkdown: m.mdxJsxFromMarkdown,
-        gfm: m.gfm,
-        gfmFromMarkdown: m.gfmFromMarkdown
-      })
-    );
+    depsPromise = import("./mdastDeps").then((m) => {
+      const d = m;
+      return {
+        fromMarkdown: d.fromMarkdown,
+        mdxJsx: d.mdxJsx,
+        mdxJsxFromMarkdown: d.mdxJsxFromMarkdown,
+        gfm: d.gfm,
+        gfmFromMarkdown: d.gfmFromMarkdown,
+        remarkAdmonitions: d.remarkAdmonitions,
+        remarkWikiLinks: d.remarkWikiLinks,
+        remarkHeadingAnchors: d.remarkHeadingAnchors
+      };
+    });
   }
   return depsPromise;
 }
-const admonitions = remarkAdmonitions;
-const wikiLinks = remarkWikiLinks;
-const headingAnchors = remarkHeadingAnchors;
 async function parseSafeMdast(source, options = {}) {
-  const { fromMarkdown, mdxJsx, mdxJsxFromMarkdown, gfm, gfmFromMarkdown } = await loadDeps();
+  const {
+    fromMarkdown,
+    mdxJsx,
+    mdxJsxFromMarkdown,
+    gfm,
+    gfmFromMarkdown,
+    remarkAdmonitions,
+    remarkWikiLinks,
+    remarkHeadingAnchors
+  } = await loadDeps();
   const tree = fromMarkdown(source, {
     // `mdxJsx()` WITHOUT an acorn option → JSX tags + literal attrs; expressions are
     // raw strings, never estree. The mdx *expression* extension is intentionally
@@ -30,9 +36,9 @@ async function parseSafeMdast(source, options = {}) {
     extensions: [mdxJsx(), gfm()],
     mdastExtensions: [mdxJsxFromMarkdown(), gfmFromMarkdown()]
   });
-  admonitions()(tree);
-  wikiLinks()(tree);
-  headingAnchors({ sectionIds: options.sectionIds !== false })(tree);
+  remarkAdmonitions()(tree);
+  remarkWikiLinks()(tree);
+  remarkHeadingAnchors({ sectionIds: options.sectionIds !== false })(tree);
   return tree;
 }
 export {

package/dist/safeContent/parseSafeMdast.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/safeContent/parseSafeMdast.ts"],"sourcesContent":["// The no-acorn parse pipeline for the safe content renderer (TRUST_MODES_SPEC §5.1,\n// empirically verified 2026-07-07 against `@mdx-js/mdx` v3 / `micromark-extension-\n// mdx-jsx`). This is the load-bearing half of the fail-safe: `<Component/>` syntax\n// parses to an element node with **literal** attributes, and every expression\n// (`n={1+1}`, `f={fetch(\"/x\")}`, `{...spread}`) is captured as an **inert raw string\n// with no estree** — because we pass **NO acorn option** to `micromark-extension-mdx-\n// jsx`. There is therefore no evaluator anywhere in the pipeline (fail-safe), unlike\n// `@mdx-js/mdx`'s `compile({format:'mdx'})` which always wires acorn.\n//\n// The §5.1 residual guarantees are also here: the expression micromark extension is\n// **not** enabled (body `{…}` stays literal text), and **no `rehype-raw`** / raw-HTML\n// passthrough exists — raw HTML blocks arrive as inert `html` mdast nodes the renderer\n// prints as text, never injected.\n//\n// `micromark`/`mdast` are ESM-only. They are loaded with a memoised dynamic `import()`\n// (the transpiler's `compile.ts` pattern) so this module sits in the package's CJS\n// build too — a CJS consumer that never renders untrusted content never `require()`s\n// an ESM-only package, and one that does gets it via Node's ESM-from-CJS import. The\n// dynamic load changes only *when* the deps resolve, never the produced tree.\n//\n// The dynamic import targets `./mdastDeps` — a SINGLE self-contained artifact that a\n// dedicated build pass (`scripts/build-safecontent-deps.mjs`) inlines the whole ESM tree\n// into (see `mdastDeps.ts` for the WHY). This keeps the `import()` boundary (a consumer\n// that never renders safe content never loads the ~300KB parser) while making the imported\n// target one already-bundled file the immediately.run sandbox resolver can fetch without\n// walking the unified/micromark conditional-exports tree — the R3-213 on-host packaging\n// gap. In jest/ts-jest and the e2e bundle the same `./mdastDeps` resolves to the source\n// re-export module, which pulls the real deps from node_modules; the produced tree is\n// identical either way.\n\nimport {\n  remarkAdmonitions,\n  remarkWikiLinks,\n  remarkHeadingAnchors,\n  type HeadingAnchorOptions,\n} from '@immediately-run/mdx-plugins';\n\n// A minimal structural mdast shape — we deliberately avoid a type dependency on the\n// ESM-only `mdast`/`unist` packages (which would break the CJS build's type surface).\nexport interface SafeMdastNode {\n  type: string;\n  value?: string;\n  name?: string | null;\n  url?: string;\n  alt?: string | null;\n  title?: string | null;\n  depth?: number;\n  ordered?: boolean;\n  lang?: string | null;\n  children?: SafeMdastNode[];\n  attributes?: SafeMdxAttribute[];\n  [key: string]: unknown;\n}\n\nexport interface SafeMdxAttribute {\n  type: 'mdxJsxAttribute' | 'mdxJsxExpressionAttribute';\n  name?: string;\n  // A literal attribute carries a string; an expression attribute carries an\n  // `mdxJsxAttributeValueExpression` object (a raw string, NO estree) or a string.\n  value?: string | { type: string; value?: string } | null;\n}\n\ntype Deps = {\n  fromMarkdown: (\n    value: string,\n    options: { extensions: unknown[]; mdastExtensions: unknown[] },\n  ) => SafeMdastNode;\n  mdxJsx: () => unknown;\n  mdxJsxFromMarkdown: () => unknown;\n  gfm: () => unknown;\n  gfmFromMarkdown: () => unknown;\n};\n\nlet depsPromise: Promise<Deps> | null = null;\n\nfunction loadDeps(): Promise<Deps> {\n  if (!depsPromise) {\n    // ONE dynamic import of the pre-inlined artifact (see the header note + `mdastDeps.ts`)\n    // instead of five bare ESM specifiers the sandbox resolver can't walk on-host.\n    depsPromise = import('./mdastDeps').then(\n      (m) =>\n        ({\n          fromMarkdown: (m as unknown as { fromMarkdown: Deps['fromMarkdown'] }).fromMarkdown,\n          mdxJsx: (m as unknown as { mdxJsx: Deps['mdxJsx'] }).mdxJsx,\n          mdxJsxFromMarkdown: (m as unknown as { mdxJsxFromMarkdown: Deps['mdxJsxFromMarkdown'] })\n            .mdxJsxFromMarkdown,\n          gfm: (m as unknown as { gfm: Deps['gfm'] }).gfm,\n          gfmFromMarkdown: (m as unknown as { gfmFromMarkdown: Deps['gfmFromMarkdown'] }).gfmFromMarkdown,\n        }) as Deps,\n    );\n  }\n  return depsPromise;\n}\n\nexport interface ParseSafeMdastOptions {\n  /** `false` ⇒ headings use plain text-slug ids (the R3-186 base; no `sec-…` section\n   *  ids, no `data-slug`) — the `sectionIds:false` frontmatter opt-out, matching the\n   *  compiled path. Default (undefined/true) ⇒ section-like headings get `sec-…` ids\n   *  (R3-211). */\n  sectionIds?: boolean;\n}\n\n// The three kernel remark plugins for the MDX *safe subset* — the SAME source the\n// compiled path (transpiler `compileMdx`) runs, imported from the shared package so the\n// two render standards can't drift (TRUST_MODES_SPEC §5 / §5.1, R3-213). They are pure\n// mdast transforms: `(options?) => (tree) => void`. `unified`'s `Plugin` type widens the\n// return to `Transformer | void`; here we invoke the transformer directly on the tree,\n// so narrow it to a plain in-place mutator.\ntype MdastMutator = (tree: SafeMdastNode) => void;\nconst admonitions = remarkAdmonitions as unknown as () => MdastMutator;\nconst wikiLinks = remarkWikiLinks as unknown as () => MdastMutator;\nconst headingAnchors = remarkHeadingAnchors as unknown as (o?: HeadingAnchorOptions) => MdastMutator;\n\n/**\n * Parse untrusted Markdown/MDX-syntax source to an mdast tree with **no evaluator in\n * the pipeline**: JSX-as-data (no acorn), GFM on, the expression extension OFF, no\n * raw-HTML re-parse. The returned tree is safe to hand to `renderMdast` — expression\n * attributes are inert strings and raw HTML is inert `html` nodes.\n *\n * After the no-acorn parse it runs the SHARED kernel remark plugins — in the SAME order\n * as the compiled path's `compile.ts` (admonitions §12 → wiki-links §13 → heading/section\n * anchors §15/R3-211; GFM is already applied via the micromark extension above) — so the\n * safe subset renders identically in both standards. The plugins only emit element nodes\n * with LITERAL attributes and set `data.hProperties.id` on headings; they add no evaluator\n * and no acorn, preserving the §5.1 fail-safe.\n */\nexport async function parseSafeMdast(\n  source: string,\n  options: ParseSafeMdastOptions = {},\n): Promise<SafeMdastNode> {\n  const { fromMarkdown, mdxJsx, mdxJsxFromMarkdown, gfm, gfmFromMarkdown } = await loadDeps();\n  const tree = fromMarkdown(source, {\n    // `mdxJsx()` WITHOUT an acorn option → JSX tags + literal attrs; expressions are\n    // raw strings, never estree. The mdx *expression* extension is intentionally\n    // absent, so `{…}` in body text stays literal. GFM for tables/task-lists.\n    extensions: [mdxJsx(), gfm()],\n    mdastExtensions: [mdxJsxFromMarkdown(), gfmFromMarkdown()],\n  });\n  admonitions()(tree);\n  wikiLinks()(tree);\n  headingAnchors({ sectionIds: options.sectionIds !== false })(tree);\n  return tree;\n}\n"],"mappings":"AA8BA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAsCP,IAAI,cAAoC;AAExC,SAAS,WAA0B;AACjC,MAAI,CAAC,aAAa;AAGhB,kBAAc,OAAO,aAAa,EAAE;AAAA,MAClC,CAAC,OACE;AAAA,QACC,cAAe,EAAwD;AAAA,QACvE,QAAS,EAA4C;AAAA,QACrD,oBAAqB,EAClB;AAAA,QACH,KAAM,EAAsC;AAAA,QAC5C,iBAAkB,EAA8D;AAAA,MAClF;AAAA,IACJ;AAAA,EACF;AACA,SAAO;AACT;AAiBA,MAAM,cAAc;AACpB,MAAM,YAAY;AAClB,MAAM,iBAAiB;AAevB,eAAsB,eACpB,QACA,UAAiC,CAAC,GACV;AACxB,QAAM,EAAE,cAAc,QAAQ,oBAAoB,KAAK,gBAAgB,IAAI,MAAM,SAAS;AAC1F,QAAM,OAAO,aAAa,QAAQ;AAAA;AAAA;AAAA;AAAA,IAIhC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;AAAA,IAC5B,iBAAiB,CAAC,mBAAmB,GAAG,gBAAgB,CAAC;AAAA,EAC3D,CAAC;AACD,cAAY,EAAE,IAAI;AAClB,YAAU,EAAE,IAAI;AAChB,iBAAe,EAAE,YAAY,QAAQ,eAAe,MAAM,CAAC,EAAE,IAAI;AACjE,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/safeContent/parseSafeMdast.ts"],"sourcesContent":["// The no-acorn parse pipeline for the safe content renderer (TRUST_MODES_SPEC §5.1,\n// empirically verified 2026-07-07 against `@mdx-js/mdx` v3 / `micromark-extension-\n// mdx-jsx`). This is the load-bearing half of the fail-safe: `<Component/>` syntax\n// parses to an element node with **literal** attributes, and every expression\n// (`n={1+1}`, `f={fetch(\"/x\")}`, `{...spread}`) is captured as an **inert raw string\n// with no estree** — because we pass **NO acorn option** to `micromark-extension-mdx-\n// jsx`. There is therefore no evaluator anywhere in the pipeline (fail-safe), unlike\n// `@mdx-js/mdx`'s `compile({format:'mdx'})` which always wires acorn.\n//\n// The §5.1 residual guarantees are also here: the expression micromark extension is\n// **not** enabled (body `{…}` stays literal text), and **no `rehype-raw`** / raw-HTML\n// passthrough exists — raw HTML blocks arrive as inert `html` mdast nodes the renderer\n// prints as text, never injected.\n//\n// `micromark`/`mdast` are ESM-only. They are loaded with a memoised dynamic `import()`\n// (the transpiler's `compile.ts` pattern) so this module sits in the package's CJS\n// build too — a CJS consumer that never renders untrusted content never `require()`s\n// an ESM-only package, and one that does gets it via Node's ESM-from-CJS import. The\n// dynamic load changes only *when* the deps resolve, never the produced tree.\n//\n// The dynamic import targets `./mdastDeps` — a SINGLE self-contained artifact that a\n// dedicated build pass (`scripts/build-safecontent-deps.mjs`) inlines the whole ESM tree\n// into (see `mdastDeps.ts` for the WHY). This keeps the `import()` boundary (a consumer\n// that never renders safe content never loads the ~300KB parser) while making the imported\n// target one already-bundled file the immediately.run sandbox resolver can fetch without\n// walking the unified/micromark conditional-exports tree — the R3-213 on-host packaging\n// gap. In jest/ts-jest and the e2e bundle the same `./mdastDeps` resolves to the source\n// re-export module, which pulls the real deps from node_modules; the produced tree is\n// identical either way.\n\n// Type-only — the plugin VALUES are re-exported from (and inlined by) `./mdastDeps`; a\n// value import here would put a bare `@immediately-run/mdx-plugins` specifier in the dist\n// the sandbox resolver can't resolve on-host. `import type` is fully erased at build.\nimport type { HeadingAnchorOptions } from '@immediately-run/mdx-plugins';\n\n// A minimal structural mdast shape — we deliberately avoid a type dependency on the\n// ESM-only `mdast`/`unist` packages (which would break the CJS build's type surface).\nexport interface SafeMdastNode {\n  type: string;\n  value?: string;\n  name?: string | null;\n  url?: string;\n  alt?: string | null;\n  title?: string | null;\n  depth?: number;\n  ordered?: boolean;\n  lang?: string | null;\n  children?: SafeMdastNode[];\n  attributes?: SafeMdxAttribute[];\n  [key: string]: unknown;\n}\n\nexport interface SafeMdxAttribute {\n  type: 'mdxJsxAttribute' | 'mdxJsxExpressionAttribute';\n  name?: string;\n  // A literal attribute carries a string; an expression attribute carries an\n  // `mdxJsxAttributeValueExpression` object (a raw string, NO estree) or a string.\n  value?: string | { type: string; value?: string } | null;\n}\n\n// `unified`'s `Plugin` type widens the return to `Transformer | void`; the safe path\n// invokes each transformer directly on the tree, so narrow it to a plain in-place mutator.\ntype MdastMutator = (tree: SafeMdastNode) => void;\n\ntype Deps = {\n  fromMarkdown: (\n    value: string,\n    options: { extensions: unknown[]; mdastExtensions: unknown[] },\n  ) => SafeMdastNode;\n  mdxJsx: () => unknown;\n  mdxJsxFromMarkdown: () => unknown;\n  gfm: () => unknown;\n  gfmFromMarkdown: () => unknown;\n  // The three shared kernel remark plugins, also inlined into `./mdastDeps` (see there).\n  remarkAdmonitions: () => MdastMutator;\n  remarkWikiLinks: () => MdastMutator;\n  remarkHeadingAnchors: (o?: HeadingAnchorOptions) => MdastMutator;\n};\n\nlet depsPromise: Promise<Deps> | null = null;\n\nfunction loadDeps(): Promise<Deps> {\n  if (!depsPromise) {\n    // ONE dynamic import of the pre-inlined artifact (see the header note + `mdastDeps.ts`)\n    // — the five ESM parser packages AND the shared remark plugins, none of which the\n    // sandbox resolver can walk/resolve as bare specifiers on-host.\n    depsPromise = import('./mdastDeps').then((m) => {\n      const d = m as unknown as Deps;\n      return {\n        fromMarkdown: d.fromMarkdown,\n        mdxJsx: d.mdxJsx,\n        mdxJsxFromMarkdown: d.mdxJsxFromMarkdown,\n        gfm: d.gfm,\n        gfmFromMarkdown: d.gfmFromMarkdown,\n        remarkAdmonitions: d.remarkAdmonitions,\n        remarkWikiLinks: d.remarkWikiLinks,\n        remarkHeadingAnchors: d.remarkHeadingAnchors,\n      } as Deps;\n    });\n  }\n  return depsPromise;\n}\n\nexport interface ParseSafeMdastOptions {\n  /** `false` ⇒ headings use plain text-slug ids (the R3-186 base; no `sec-…` section\n   *  ids, no `data-slug`) — the `sectionIds:false` frontmatter opt-out, matching the\n   *  compiled path. Default (undefined/true) ⇒ section-like headings get `sec-…` ids\n   *  (R3-211). */\n  sectionIds?: boolean;\n}\n\n/**\n * Parse untrusted Markdown/MDX-syntax source to an mdast tree with **no evaluator in\n * the pipeline**: JSX-as-data (no acorn), GFM on, the expression extension OFF, no\n * raw-HTML re-parse. The returned tree is safe to hand to `renderMdast` — expression\n * attributes are inert strings and raw HTML is inert `html` nodes.\n *\n * After the no-acorn parse it runs the SHARED kernel remark plugins — in the SAME order\n * as the compiled path's `compile.ts` (admonitions §12 → wiki-links §13 → heading/section\n * anchors §15/R3-211; GFM is already applied via the micromark extension above) — so the\n * safe subset renders identically in both standards. The plugins only emit element nodes\n * with LITERAL attributes and set `data.hProperties.id` on headings; they add no evaluator\n * and no acorn, preserving the §5.1 fail-safe.\n */\nexport async function parseSafeMdast(\n  source: string,\n  options: ParseSafeMdastOptions = {},\n): Promise<SafeMdastNode> {\n  const {\n    fromMarkdown,\n    mdxJsx,\n    mdxJsxFromMarkdown,\n    gfm,\n    gfmFromMarkdown,\n    remarkAdmonitions,\n    remarkWikiLinks,\n    remarkHeadingAnchors,\n  } = await loadDeps();\n  const tree = fromMarkdown(source, {\n    // `mdxJsx()` WITHOUT an acorn option → JSX tags + literal attrs; expressions are\n    // raw strings, never estree. The mdx *expression* extension is intentionally\n    // absent, so `{…}` in body text stays literal. GFM for tables/task-lists.\n    extensions: [mdxJsx(), gfm()],\n    mdastExtensions: [mdxJsxFromMarkdown(), gfmFromMarkdown()],\n  });\n  // The SHARED kernel remark plugins, in the SAME order as the compiled path's `compile.ts`\n  // (admonitions §12 → wiki-links §13 → heading/section anchors §15/R3-211).\n  remarkAdmonitions()(tree);\n  remarkWikiLinks()(tree);\n  remarkHeadingAnchors({ sectionIds: options.sectionIds !== false })(tree);\n  return tree;\n}\n"],"mappings":";AA+EA,IAAI,cAAoC;AAExC,SAAS,WAA0B;AACjC,MAAI,CAAC,aAAa;AAIhB,kBAAc,OAAO,aAAa,EAAE,KAAK,CAAC,MAAM;AAC9C,YAAM,IAAI;AACV,aAAO;AAAA,QACL,cAAc,EAAE;AAAA,QAChB,QAAQ,EAAE;AAAA,QACV,oBAAoB,EAAE;AAAA,QACtB,KAAK,EAAE;AAAA,QACP,iBAAiB,EAAE;AAAA,QACnB,mBAAmB,EAAE;AAAA,QACrB,iBAAiB,EAAE;AAAA,QACnB,sBAAsB,EAAE;AAAA,MAC1B;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAuBA,eAAsB,eACpB,QACA,UAAiC,CAAC,GACV;AACxB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,SAAS;AACnB,QAAM,OAAO,aAAa,QAAQ;AAAA;AAAA;AAAA;AAAA,IAIhC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;AAAA,IAC5B,iBAAiB,CAAC,mBAAmB,GAAG,gBAAgB,CAAC;AAAA,EAC3D,CAAC;AAGD,oBAAkB,EAAE,IAAI;AACxB,kBAAgB,EAAE,IAAI;AACtB,uBAAqB,EAAE,YAAY,QAAQ,eAAe,MAAM,CAAC,EAAE,IAAI;AACvE,SAAO;AACT;","names":[]}

package/dist/safeContent/renderMdast.js

@@ -1,3 +1,4 @@
+import "../chunk-VHAA22YE.js";
 import { createElement, Fragment } from "react";
 import { sanitizeUrl } from "./sanitizeUrl";
 import { splitWikiLinks } from "./wikilink";