@k2b/cloud 0.6.0-rc.0

package/src/shared/markdown/index.ts

@@ -0,0 +1,193 @@
+/**
+ * Server-side Markdown renderer using marked.js
+ *
+ * This module provides markdown rendering that produces HTML matching
+ * the visual appearance of the CodeMirror editor extensions.
+ */
+
+import { Marked } from "marked";
+import sanitizeHtml from "sanitize-html";
+import { markdownClient } from "./client";
+import { codeExtension } from "./extensions/code";
+import { guidedHelpExtension } from "./extensions/guided-help";
+import { imagesExtension } from "./extensions/images";
+import { infoBlocksExtension } from "./extensions/info-blocks";
+import { katexExtension } from "./extensions/katex";
+import { linksExtension } from "./extensions/links";
+import { markExtension } from "./extensions/mark";
+import { subSupExtension } from "./extensions/sub-sup";
+import { tablesExtension } from "./extensions/tables";
+import { taskListExtension } from "./extensions/task-list";
+
+// Create a configured marked instance
+type MarkdownProfile = "content" | "help";
+
+const createMarked = (profile: MarkdownProfile = "content") => {
+  const marked = new Marked();
+
+  marked.use({
+    breaks: true,
+    gfm: true,
+  });
+
+  // Apply extensions in order
+  // Note: katexExtension must come before codeExtension to handle ```math blocks
+  marked.use(infoBlocksExtension());
+  marked.use(taskListExtension());
+  marked.use(tablesExtension());
+  marked.use(linksExtension({ internalTarget: profile === "help" ? "_self" : "_blank" }));
+  marked.use(imagesExtension());
+  marked.use(katexExtension());
+  marked.use(codeExtension());
+  // Inline-style decorators come last so they run after structural tokenizers.
+  marked.use(markExtension());
+  marked.use(subSupExtension());
+  if (profile === "help") marked.use(guidedHelpExtension());
+
+  return marked;
+};
+
+const marked = createMarked();
+const helpMarked = createMarked("help");
+
+const sanitizeRenderedHtml = (html: string): string =>
+  sanitizeHtml(html, {
+    allowedTags: [
+      ...sanitizeHtml.defaults.allowedTags,
+      "annotation",
+      "aside",
+      "br",
+      "div",
+      "figcaption",
+      "figure",
+      "i",
+      "img",
+      "input",
+      "mark",
+      "math",
+      "mfrac",
+      "mi",
+      "mn",
+      "mo",
+      "mover",
+      "mrow",
+      "msqrt",
+      "msub",
+      "msubsup",
+      "msup",
+      "mtext",
+      "semantics",
+      "span",
+      "sub",
+      "sup",
+      "table",
+      "tbody",
+      "td",
+      "th",
+      "thead",
+      "tr",
+    ],
+    allowedAttributes: {
+      "*": ["aria-hidden", "aria-label", "class", "data-help-icon", "data-tone", "id", "title"],
+      a: ["href", "name", "rel", "target", "title"],
+      annotation: ["encoding"],
+      code: ["class"],
+      div: ["class", "data-block-name", "style"],
+      img: ["alt", "class", "height", "loading", "src", "title", "width", "style"],
+      input: ["checked", "class", "disabled", "type"],
+      math: ["xmlns"],
+      pre: ["class"],
+      span: ["aria-hidden", "class", "style", "title"],
+    },
+    allowedSchemes: ["http", "https", "mailto", "tel", "note", "attach"],
+    allowedSchemesByTag: {
+      img: ["http", "https", "attach"],
+    },
+    allowedStyles: {
+      div: {
+        height: [/^\d+(?:\.\d+)?px$/],
+      },
+      img: {
+        "max-height": [/^none$/, /^\d+(?:\.\d+)?px$/],
+        "max-width": [/^\d+(?:\.\d+)?px$/],
+      },
+      span: {
+        "margin-right": [/^-?\d+(?:\.\d+)?em$/],
+        top: [/^-?\d+(?:\.\d+)?em$/],
+        width: [/^\d+(?:\.\d+)?%$/],
+      },
+    },
+  });
+
+/**
+ * Render markdown to HTML for server-side display.
+ * The output matches the visual styling of the CodeMirror editor.
+ *
+ * Supported features:
+ * - GFM (GitHub Flavored Markdown)
+ * - Notice cards (:::note, :::info, :::success, :::warning, :::danger)
+ * - Task lists with checkboxes
+ * - Tables with cell formatting
+ * - Styled links and images
+ * - Code blocks with language badges
+ * - Mermaid diagram containers (requires client-side init)
+ *
+ * @example
+ * ```tsx
+ * // In page.tsx (server-side):
+ * import { renderMarkdown } from "@/shared/markdown";
+ * const html = renderMarkdown(markdownContent);
+ *
+ * // Pass to MarkdownView component:
+ * import { MarkdownView } from "@k2b/ui";
+ * <MarkdownView trustedHtml={html} />
+ * ```
+ *
+ * @see MarkdownView component for displaying the rendered HTML
+ * @see initMarkdownEnhancements for client-side Mermaid support
+ */
+export function renderMarkdown(content: string): string {
+  if (!content || typeof content !== "string") return "";
+
+  const html = marked.parse(content);
+  if (typeof html !== "string") return "";
+
+  return sanitizeRenderedHtml(html);
+}
+
+/**
+ * Render markdown to HTML synchronously.
+ */
+export function renderMarkdownSync(content: string): string {
+  if (!content || typeof content !== "string") return "";
+
+  const html = marked.parse(content);
+  if (typeof html !== "string") return "";
+
+  return sanitizeRenderedHtml(html);
+}
+
+/**
+ * Render trusted documentation Markdown with guided sections and internal
+ * navigation. All fenced code remains visible source, as in ordinary Markdown.
+ */
+export function renderHelpMarkdown(content: string): string {
+  if (!content || typeof content !== "string") return "";
+  const html = helpMarked.parse(content);
+  return typeof html === "string" ? sanitizeRenderedHtml(html) : "";
+}
+
+/** Plain text used by lightweight client-side help search indexes. */
+export function markdownToPlainText(content: string): string {
+  const html = renderHelpMarkdown(content);
+  return sanitizeHtml(html, { allowedTags: [], allowedAttributes: {} }).replace(/\s+/g, " ").trim();
+}
+
+export { marked };
+
+export const markdown = {
+  render: renderMarkdown,
+  renderSync: renderMarkdownSync,
+  marked,
+  client: markdownClient,
+} as const;

package/src/shared/markdown/shared.ts

@@ -0,0 +1,36 @@
+/**
+ * Shared utilities for markdown rendering
+ *
+ * Used by both CodeMirror editor extensions and marked renderer extensions
+ * to ensure consistent behavior and avoid code duplication.
+ */
+
+/**
+ * Escape HTML special characters to prevent XSS
+ *
+ * @example
+ * escapeHtml('<script>alert("xss")</script>')
+ * // Returns: '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'
+ */
+export const escapeHtml = (text: string): string => {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+};
+
+// =============================================================================
+// Shared CSS Classes (match CodeMirror and marked renderer)
+// =============================================================================
+
+/** Image widget styles */
+export const IMAGE_STYLES = {
+  wrapper: "md-image-widget my-2",
+  figure: "flex flex-col items-center justify-center max-w-full",
+  img: "block max-h-[400px] rounded border border-gray-200 dark:border-gray-700",
+  caption: "text-sm text-gray-500 dark:text-gray-400 mt-2 italic",
+} as const;
+
+/** Link widget styles */
+export const LINK_STYLES = {
+  link: "md-link-widget",
+  label: "md-link-label",
+  icon: "md-link-icon",
+} as const;

package/src/shared/mock-cover.ts

@@ -0,0 +1,130 @@
+import { Buffer } from "node:buffer";
+
+export type MockCoverTheme = "blue" | "emerald" | "amber" | "rose" | "violet" | "slate" | "teal";
+
+export type MockCoverIcon = "book" | "camera" | "device-projector" | "microphone" | "package";
+
+export type MockCoverOptions = {
+  icon?: MockCoverIcon | string;
+  theme?: MockCoverTheme;
+  seed?: string;
+  label?: string;
+  size?: number;
+};
+
+export type MockCover = {
+  svg: string;
+  dataUrl: string;
+  mimeType: "image/svg+xml";
+};
+
+const themes: Record<MockCoverTheme, { from: string; to: string; accent: string; panel: string }> = {
+  blue: { from: "#dbeafe", to: "#93c5fd", accent: "#2563eb", panel: "#eff6ff" },
+  emerald: { from: "#d1fae5", to: "#6ee7b7", accent: "#059669", panel: "#ecfdf5" },
+  amber: { from: "#fef3c7", to: "#fbbf24", accent: "#d97706", panel: "#fffbeb" },
+  rose: { from: "#ffe4e6", to: "#fda4af", accent: "#e11d48", panel: "#fff1f2" },
+  violet: { from: "#ede9fe", to: "#c4b5fd", accent: "#7c3aed", panel: "#f5f3ff" },
+  slate: { from: "#e2e8f0", to: "#94a3b8", accent: "#475569", panel: "#f8fafc" },
+  teal: { from: "#ccfbf1", to: "#5eead4", accent: "#0f766e", panel: "#f0fdfa" },
+};
+
+const themeNames = Object.keys(themes) as MockCoverTheme[];
+
+const iconPaths: Record<MockCoverIcon, string[]> = {
+  book: ["M3 19a9 9 0 0 1 9 0a9 9 0 0 1 9 0", "M3 6a9 9 0 0 1 9 0a9 9 0 0 1 9 0", "M3 6l0 13", "M12 6l0 13", "M21 6l0 13"],
+  camera: [
+    "M5 7h1a2 2 0 0 0 2 -2a1 1 0 0 1 1 -1h6a1 1 0 0 1 1 1a2 2 0 0 0 2 2h1a2 2 0 0 1 2 2v9a2 2 0 0 1 -2 2h-14a2 2 0 0 1 -2 -2v-9a2 2 0 0 1 2 -2",
+    "M9 13a3 3 0 1 0 6 0a3 3 0 0 0 -6 0",
+  ],
+  "device-projector": [
+    "M8 9a5 5 0 1 0 10 0a5 5 0 0 0 -10 0",
+    "M9 6h-4a2 2 0 0 0 -2 2v8a2 2 0 0 0 2 2h14a2 2 0 0 0 2 -2v-8a2 2 0 0 0 -2 -2h-2",
+    "M6 15h1",
+    "M7 18l-1 2",
+    "M18 18l1 2",
+  ],
+  microphone: [
+    "M9 5a3 3 0 0 1 3 -3a3 3 0 0 1 3 3v5a3 3 0 0 1 -3 3a3 3 0 0 1 -3 -3l0 -5",
+    "M5 10a7 7 0 0 0 14 0",
+    "M8 21l8 0",
+    "M12 17l0 4",
+  ],
+  package: ["M12 3l8 4.5l0 9l-8 4.5l-8 -4.5l0 -9l8 -4.5", "M12 12l8 -4.5", "M12 12l0 9", "M12 12l-8 -4.5", "M16 5.25l-8 4.5"],
+};
+
+const aliases: Record<string, MockCoverIcon> = {
+  books: "book",
+  "ti ti-book": "book",
+  "ti ti-books": "book",
+  "ti ti-camera": "camera",
+  "ti ti-device-projector": "device-projector",
+  "ti ti-microphone": "microphone",
+  "ti ti-package": "package",
+  "ti ti-packages": "package",
+};
+
+const hashSeed = (seed: string): number => {
+  let hash = 2166136261;
+  for (let i = 0; i < seed.length; i += 1) {
+    hash ^= seed.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return hash >>> 0;
+};
+
+const escapeXml = (value: string): string =>
+  value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+
+const resolveIcon = (icon: MockCoverOptions["icon"]): MockCoverIcon => {
+  const key = String(icon ?? "package")
+    .trim()
+    .toLowerCase();
+  if (key in iconPaths) return key as MockCoverIcon;
+  return aliases[key] ?? "package";
+};
+
+export const createMockCoverSvg = (options: MockCoverOptions = {}): string => {
+  const size = Math.max(160, Math.min(options.size ?? 720, 1600));
+  const seed = options.seed ?? options.label ?? options.icon ?? "mock-cover";
+  const themeName = options.theme ?? themeNames[hashSeed(String(seed)) % themeNames.length] ?? "blue";
+  const theme = themes[themeName];
+  const icon = resolveIcon(options.icon);
+  const gradientId = `g${hashSeed(`${seed}:gradient`).toString(36)}`;
+  const title = escapeXml(options.label ?? "Mock cover");
+  const iconMarkup = iconPaths[icon].map((path) => `<path d="${path}" />`).join("");
+
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${size}" height="${size}" viewBox="0 0 720 720" role="img" aria-label="${title}">
+  <defs>
+    <linearGradient id="${gradientId}" x1="72" x2="648" y1="72" y2="648" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="${theme.from}" />
+      <stop offset="1" stop-color="${theme.to}" />
+    </linearGradient>
+    <filter id="shadow" x="-20%" y="-20%" width="140%" height="140%" color-interpolation-filters="sRGB">
+      <feDropShadow dx="0" dy="22" stdDeviation="24" flood-color="#0f172a" flood-opacity=".16" />
+    </filter>
+  </defs>
+  <rect width="720" height="720" fill="url(#${gradientId})" />
+  <rect x="160" y="160" width="400" height="400" rx="96" fill="${theme.panel}" opacity=".92" filter="url(#shadow)" />
+  <g transform="translate(216 216) scale(12)" fill="none" stroke="${theme.accent}" stroke-width="1.55" stroke-linecap="round" stroke-linejoin="round">
+    ${iconMarkup}
+  </g>
+</svg>`;
+};
+
+export const createMockCover = (options: MockCoverOptions = {}): MockCover => {
+  const svg = createMockCoverSvg(options);
+  return {
+    svg,
+    dataUrl: `data:image/svg+xml;base64,${Buffer.from(svg, "utf8").toString("base64")}`,
+    mimeType: "image/svg+xml",
+  };
+};
+
+export const parseDataUrl = (dataUrl: string): { mimeType: string; bytes: Uint8Array } | null => {
+  const match = /^data:([^;,]+);base64,(.+)$/s.exec(dataUrl);
+  if (!match) return null;
+  return {
+    mimeType: match[1] || "application/octet-stream",
+    bytes: new Uint8Array(Buffer.from(match[2] ?? "", "base64")),
+  };
+};

package/src/shared/network-address.ts

@@ -0,0 +1,106 @@
+const ipv4ToNumber = (address: string): number | null => {
+  const parts = address.split(".");
+  if (parts.length !== 4 || parts.some((part) => !/^(0|[1-9]\d{0,2})$/.test(part))) return null;
+  const values = parts.map(Number);
+  if (values.some((part) => part > 255)) return null;
+  return values.reduce((value, part) => (value * 256 + part) >>> 0, 0);
+};
+
+const ipv4InRange = (address: string, base: string, bits: number): boolean => {
+  const value = ipv4ToNumber(address);
+  const baseValue = ipv4ToNumber(base);
+  if (value === null || baseValue === null) return true;
+  const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0;
+  return (value & mask) === (baseValue & mask);
+};
+
+const UNSAFE_IPV4_RANGES: ReadonlyArray<readonly [string, number]> = [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.88.99.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4],
+];
+
+const ipv6ToBigInt = (rawAddress: string): bigint | null => {
+  let address = rawAddress.toLowerCase().split("%")[0] ?? "";
+  if (address.includes(".")) {
+    const separator = address.lastIndexOf(":");
+    const ipv4 = ipv4ToNumber(address.slice(separator + 1));
+    if (separator < 0 || ipv4 === null) return null;
+    address = `${address.slice(0, separator)}:${(ipv4 >>> 16).toString(16)}:${(ipv4 & 0xffff).toString(16)}`;
+  }
+  const halves = address.split("::");
+  if (halves.length > 2) return null;
+  const left = halves[0] ? halves[0].split(":") : [];
+  const right = halves[1] ? halves[1].split(":") : [];
+  const missing = halves.length === 2 ? 8 - left.length - right.length : 0;
+  if (missing < 0 || (halves.length === 1 && left.length !== 8)) return null;
+  const groups = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+  if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/.test(group))) return null;
+  return groups.reduce((value, group) => (value << 16n) | BigInt(`0x${group}`), 0n);
+};
+
+const ipv6InRange = (address: bigint, base: bigint, bits: number): boolean => {
+  const shift = BigInt(128 - bits);
+  return address >> shift === base >> shift;
+};
+
+const UNSAFE_IPV6_RANGES: ReadonlyArray<readonly [bigint, number]> = [
+  [ipv6ToBigInt("::")!, 96],
+  [ipv6ToBigInt("64:ff9b::")!, 96],
+  [ipv6ToBigInt("64:ff9b:1::")!, 48],
+  [ipv6ToBigInt("100::")!, 64],
+  [ipv6ToBigInt("2001::")!, 32],
+  [ipv6ToBigInt("2001:2::")!, 48],
+  [ipv6ToBigInt("2001:db8::")!, 32],
+  [ipv6ToBigInt("2002::")!, 16],
+  [ipv6ToBigInt("fc00::")!, 7],
+  [ipv6ToBigInt("fe80::")!, 10],
+  [ipv6ToBigInt("fec0::")!, 10],
+  [ipv6ToBigInt("ff00::")!, 8],
+];
+
+export const normalizeNetworkHostname = (hostname: string): string =>
+  hostname
+    .toLowerCase()
+    .replace(/^\[|\]$/g, "")
+    .replace(/\.$/, "");
+
+export const networkAddressFamily = (rawAddress: string): 4 | 6 | null => {
+  const address = normalizeNetworkHostname(rawAddress);
+  if (ipv4ToNumber(address) !== null) return 4;
+  return ipv6ToBigInt(address) !== null ? 6 : null;
+};
+
+export const isUnsafeNetworkAddress = (rawAddress: string): boolean => {
+  const address = normalizeNetworkHostname(rawAddress);
+  const family = networkAddressFamily(address);
+  if (family === 4) return UNSAFE_IPV4_RANGES.some(([base, bits]) => ipv4InRange(address, base, bits));
+  if (family !== 6) return true;
+  const value = ipv6ToBigInt(address);
+  if (value === null) return true;
+  if (value >> 32n === 0xffffn) {
+    const mapped = Number(value & 0xffffffffn);
+    const ipv4 = [mapped >>> 24, (mapped >>> 16) & 255, (mapped >>> 8) & 255, mapped & 255].join(".");
+    return isUnsafeNetworkAddress(ipv4);
+  }
+  return UNSAFE_IPV6_RANGES.some(([base, bits]) => ipv6InRange(value, base, bits));
+};
+
+export const isUnsafeNetworkHostname = (rawHostname: string): boolean => {
+  const hostname = normalizeNetworkHostname(rawHostname);
+  return (
+    hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "metadata.google.internal" || hostname.endsWith(".internal")
+  );
+};

package/src/shared/redirect.ts

@@ -0,0 +1,56 @@
+const REDIRECT_BASE = "https://cloud.local";
+
+/** Normalize a user-provided post-login redirect to a local Cloud path. */
+export const normalizeRedirectTo = (value: string | null | undefined): string | undefined => {
+  if (!value) return undefined;
+
+  const trimmed = value.trim();
+  if (!trimmed || !trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) return undefined;
+
+  try {
+    const url = new URL(trimmed, REDIRECT_BASE);
+    if (url.origin !== REDIRECT_BASE) return undefined;
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return undefined;
+  }
+};
+
+/** Extract a safe post-login redirect target from an incoming request URL. */
+export const redirectPathFromRequestUrl = (requestUrl: string): string => {
+  const url = new URL(requestUrl);
+  return normalizeRedirectTo(`${url.pathname}${url.search}`) ?? "/";
+};
+
+/** Build the local login URL for an incoming protected request. */
+export const createLoginRedirectUrl = (requestUrl: string): string => {
+  const params = new URLSearchParams();
+  params.set("redirectTo", redirectPathFromRequestUrl(requestUrl));
+  return `/auth/login?${params.toString()}`;
+};
+
+/** Build an absolute auth login URL while preserving only safe local redirects. */
+export const createAuthLoginUrl = (
+  appUrl: string,
+  params: { token?: string; method?: "email" | "ipa" | "admin"; redirectTo?: string | null | undefined } = {},
+): string => {
+  const url = new URL(`${appUrl.replace(/\/$/, "")}/auth/login`);
+  if (params.token) url.searchParams.set("token", params.token);
+  if (params.method) url.searchParams.set("method", params.method);
+
+  const redirectTo = normalizeRedirectTo(params.redirectTo);
+  if (redirectTo) url.searchParams.set("redirectTo", redirectTo);
+
+  return url.toString();
+};
+
+/** Build an absolute password-reset URL while preserving only safe local redirects. */
+export const createAuthPasswordResetUrl = (appUrl: string, params: { token: string; redirectTo?: string | null | undefined }): string => {
+  const url = new URL(`${appUrl.replace(/\/$/, "")}/auth/password-reset`);
+  url.searchParams.set("token", params.token);
+
+  const redirectTo = normalizeRedirectTo(params.redirectTo);
+  if (redirectTo) url.searchParams.set("redirectTo", redirectTo);
+
+  return url.toString();
+};

package/src/shared/template-rendering.ts

@@ -0,0 +1,140 @@
+import { Liquid } from "liquidjs";
+
+const TEMPLATE_MAX_BYTES = 200_000;
+const RENDER_MAX_BYTES = 300_000;
+
+type LiquidEngine = Liquid;
+export type LiquidTemplateErrorReason = "render_too_large";
+
+export class LiquidTemplateError extends Error {
+  constructor(
+    readonly reason: LiquidTemplateErrorReason,
+    message: string,
+  ) {
+    super(message);
+    this.name = "LiquidTemplateError";
+  }
+}
+
+export type LiquidTemplateFilter = Parameters<LiquidEngine["registerFilter"]>[1];
+export type LiquidTemplateOptions = {
+  filters?: Record<string, LiquidTemplateFilter>;
+  escapeOutput?: boolean | ((value: unknown) => string);
+  templateMaxBytes?: number;
+  renderMaxBytes?: number;
+  memoryLimit?: number;
+};
+
+const ALLOWED_TAGS = new Set([
+  "if",
+  "elsif",
+  "else",
+  "endif",
+  "unless",
+  "endunless",
+  "for",
+  "break",
+  "continue",
+  "endfor",
+  "case",
+  "when",
+  "endcase",
+  "assign",
+  "capture",
+  "endcapture",
+  "comment",
+  "endcomment",
+  "raw",
+  "endraw",
+]);
+
+const TEMPLATE_TAG_RE = /{%-?\s*([A-Za-z_][A-Za-z0-9_]*)\b/g;
+
+const byteLength = (value: string): number => new TextEncoder().encode(value).byteLength;
+
+export const escapeTemplateOutput = (value: unknown): string =>
+  String(value).replace(/[&<>"'`=/]/g, (char) => {
+    switch (char) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      case "'":
+        return "&#39;";
+      case "`":
+        return "&#x60;";
+      case "=":
+        return "&#x3D;";
+      case "/":
+        return "&#x2F;";
+      default:
+        return char;
+    }
+  });
+
+const createEngine = (options: LiquidTemplateOptions = {}) => {
+  const outputEscape =
+    typeof options.escapeOutput === "function" ? options.escapeOutput : options.escapeOutput === false ? undefined : escapeTemplateOutput;
+  const engine = new Liquid({
+    strictVariables: true,
+    strictFilters: true,
+    ownPropertyOnly: true,
+    ...(outputEscape ? { outputEscape } : {}),
+    parseLimit: options.templateMaxBytes ?? TEMPLATE_MAX_BYTES,
+    renderLimit: options.renderMaxBytes ?? RENDER_MAX_BYTES,
+    memoryLimit: options.memoryLimit ?? 2_000_000,
+    cache: false,
+    dynamicPartials: false,
+    root: [],
+    layouts: [],
+    partials: [],
+  });
+
+  for (const [name, filter] of Object.entries(options.filters ?? {})) engine.registerFilter(name, filter);
+  return engine;
+};
+
+const defaultEngine = createEngine();
+const engineFor = (options: LiquidTemplateOptions = {}) => (Object.keys(options).length > 0 ? createEngine(options) : defaultEngine);
+
+export const migrateLegacyMustacheTemplate = (template: string): string =>
+  template
+    .replace(/{{#\s*([A-Za-z_][A-Za-z0-9_]*)\s*}}([\s\S]*?){{\/\s*\1\s*}}/g, "{% if $1 != blank %}$2{% endif %}")
+    .replace(/{{\^\s*([A-Za-z_][A-Za-z0-9_]*)\s*}}([\s\S]*?){{\/\s*\1\s*}}/g, "{% if $1 == blank %}$2{% endif %}");
+
+export const validateLiquidTemplate = (
+  template: string,
+  options: LiquidTemplateOptions = {},
+): { ok: true } | { ok: false; error: string } => {
+  if (byteLength(template) > (options.templateMaxBytes ?? TEMPLATE_MAX_BYTES)) return { ok: false, error: "Template is too large" };
+  for (const match of template.matchAll(TEMPLATE_TAG_RE)) {
+    const tag = match[1]!;
+    if (!ALLOWED_TAGS.has(tag)) return { ok: false, error: `Liquid tag "${tag}" is not allowed` };
+  }
+  try {
+    engineFor(options).parse(template);
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : "Invalid Liquid template" };
+  }
+};
+
+export const renderLiquidTemplate = (template: string, data: Record<string, unknown>, options: LiquidTemplateOptions = {}): string => {
+  const valid = validateLiquidTemplate(template, options);
+  if (!valid.ok) throw new Error(valid.error);
+  const rendered = engineFor(options).parseAndRenderSync(template, data);
+  if (byteLength(rendered) > (options.renderMaxBytes ?? RENDER_MAX_BYTES)) {
+    throw new LiquidTemplateError("render_too_large", "Rendered template is too large");
+  }
+  return rendered;
+};
+
+export const liquidTemplateVariables = (template: string, options: LiquidTemplateOptions = {}): string[] => {
+  const valid = validateLiquidTemplate(template, options);
+  if (!valid.ok) throw new Error(valid.error);
+  return engineFor(options).globalFullVariablesSync(template);
+};