@mintlify/package-builder 0.0.0-stage → 0.0.3

package/dist/sanitize.js

@@ -0,0 +1,650 @@
+import { decodeHTMLAttribute } from 'entities/decode';
+export const MAX_ISLAND_HTML_BYTES = 256 * 1024;
+const HTML_ELEMENTS = [
+    'a',
+    'abbr',
+    'address',
+    'area',
+    'article',
+    'aside',
+    'audio',
+    'b',
+    'bdi',
+    'bdo',
+    'big',
+    'blockquote',
+    'br',
+    'button',
+    'canvas',
+    'caption',
+    'center',
+    'cite',
+    'code',
+    'col',
+    'colgroup',
+    'data',
+    'datalist',
+    'dd',
+    'del',
+    'details',
+    'dfn',
+    'dialog',
+    'div',
+    'dl',
+    'dt',
+    'em',
+    'fieldset',
+    'figcaption',
+    'figure',
+    'font',
+    'footer',
+    'h1',
+    'h2',
+    'h3',
+    'h4',
+    'h5',
+    'h6',
+    'header',
+    'hgroup',
+    'hr',
+    'i',
+    'img',
+    'input',
+    'ins',
+    'kbd',
+    'label',
+    'legend',
+    'li',
+    'main',
+    'map',
+    'mark',
+    'menu',
+    'meter',
+    'nav',
+    'nobr',
+    'ol',
+    'optgroup',
+    'option',
+    'output',
+    'p',
+    'picture',
+    'pre',
+    'progress',
+    'q',
+    'rp',
+    'rt',
+    'ruby',
+    's',
+    'samp',
+    'search',
+    'section',
+    'select',
+    'slot',
+    'small',
+    'source',
+    'span',
+    'strike',
+    'strong',
+    'sub',
+    'summary',
+    'sup',
+    'table',
+    'tbody',
+    'td',
+    'template',
+    'textarea',
+    'tfoot',
+    'th',
+    'thead',
+    'time',
+    'title',
+    'tr',
+    'track',
+    'tt',
+    'u',
+    'ul',
+    'var',
+    'video',
+    'wbr',
+];
+const SVG_ELEMENTS = [
+    'svg',
+    'g',
+    'path',
+    'circle',
+    'ellipse',
+    'line',
+    'polyline',
+    'polygon',
+    'rect',
+    'text',
+    'tspan',
+    'textpath',
+    'defs',
+    'lineargradient',
+    'radialgradient',
+    'stop',
+    'clippath',
+    'mask',
+    'pattern',
+    'marker',
+    'symbol',
+    'use',
+    'image',
+    'desc',
+    'metadata',
+    'filter',
+    'switch',
+    'view',
+    'feblend',
+    'fecolormatrix',
+    'fecomponenttransfer',
+    'fecomposite',
+    'feconvolvematrix',
+    'fediffuselighting',
+    'fedisplacementmap',
+    'fedistantlight',
+    'fedropshadow',
+    'feflood',
+    'fefunca',
+    'fefuncb',
+    'fefuncg',
+    'fefuncr',
+    'fegaussianblur',
+    'feimage',
+    'femerge',
+    'femergenode',
+    'femorphology',
+    'feoffset',
+    'fepointlight',
+    'fespecularlighting',
+    'fespotlight',
+    'fetile',
+    'feturbulence',
+];
+const MATHML_ELEMENTS = [
+    'math',
+    'mi',
+    'mn',
+    'mo',
+    'ms',
+    'mtext',
+    'mrow',
+    'msup',
+    'msub',
+    'msubsup',
+    'mfrac',
+    'msqrt',
+    'mroot',
+    'mtable',
+    'mtr',
+    'mtd',
+    'mspace',
+    'mstyle',
+    'mpadded',
+    'mphantom',
+    'menclose',
+    'munder',
+    'mover',
+    'munderover',
+    'semantics',
+    'annotation',
+];
+const ALLOWED_ELEMENTS = new Set([...HTML_ELEMENTS, ...SVG_ELEMENTS, ...MATHML_ELEMENTS]);
+const DROP_WITH_CONTENT = new Set([
+    'script',
+    'style',
+    'iframe',
+    'object',
+    'embed',
+    'frame',
+    'frameset',
+    'applet',
+    'noscript',
+    'noembed',
+    'noframes',
+    'xmp',
+    'plaintext',
+    'foreignobject',
+    'annotation-xml',
+    'base',
+    'meta',
+    'link',
+    'param',
+    'animate',
+    'animatemotion',
+    'animatetransform',
+    'set',
+    'discard',
+    'handler',
+    'listener',
+    'portal',
+    'fencedframe',
+]);
+const RAW_TEXT = new Set(['script', 'style', 'xmp', 'iframe', 'noembed', 'noframes', 'noscript']);
+const RCDATA = new Set(['textarea', 'title']);
+const VOID_ELEMENTS = new Set([
+    'area',
+    'base',
+    'br',
+    'col',
+    'embed',
+    'hr',
+    'img',
+    'input',
+    'keygen',
+    'link',
+    'meta',
+    'param',
+    'source',
+    'track',
+    'wbr',
+]);
+const URL_ATTRIBUTES = new Set([
+    'href',
+    'xlink:href',
+    'src',
+    'action',
+    'poster',
+    'background',
+    'cite',
+    'data',
+    'longdesc',
+    'lowsrc',
+    'dynsrc',
+    'manifest',
+    'codebase',
+    'icon',
+]);
+const SRCSET_ATTRIBUTES = new Set(['srcset', 'imagesrcset']);
+const DROPPED_ATTRIBUTES = new Set([
+    'srcdoc',
+    'ping',
+    'is',
+    'http-equiv',
+    'form',
+    'formaction',
+    'formenctype',
+    'formmethod',
+    'formnovalidate',
+    'formtarget',
+]);
+const ID_REFERENCE_ATTRIBUTES = new Set([
+    'for',
+    'list',
+    'headers',
+    'itemref',
+    'anchor',
+    'contextmenu',
+    'popovertarget',
+    'commandfor',
+    'interestfor',
+    'aria-activedescendant',
+    'aria-actions',
+    'aria-controls',
+    'aria-describedby',
+    'aria-details',
+    'aria-errormessage',
+    'aria-flowto',
+    'aria-labelledby',
+    'aria-owns',
+]);
+const TARGET_KEYWORDS = new Set(['', '_blank', '_self', '_parent', '_top']);
+const ALLOWED_COMMENT = /^(?: |\$|\/\$|\$!|\$\?|&|\/&|F!|F|)$/;
+const ATTRIBUTE_NAME = /^[a-zA-Z_:][-a-zA-Z0-9_:.]*$/;
+const SAFE_SCHEMES = new Set(['http', 'https', 'mailto', 'tel']);
+export function decodeEntities(value) {
+    return decodeHTMLAttribute(value);
+}
+function escapeAttribute(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/"/g, '"')
+        .replace(/'/g, ''')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
+function escapeText(value) {
+    return value.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+function urlScheme(value) {
+    const cleaned = value.replace(/[\u0000- \u007f-\u009f]/g, '');
+    const m = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(cleaned);
+    return m ? m[1].toLowerCase() : undefined;
+}
+function isSafeUrl(value, opts) {
+    const scheme = urlScheme(value);
+    if (scheme === undefined)
+        return true;
+    if (SAFE_SCHEMES.has(scheme))
+        return true;
+    if (scheme === 'data' && opts.allowDataImage) {
+        const cleaned = value.replace(/[\u0000- ]/g, '').toLowerCase();
+        return (/^data:image\/(?:png|jpe?g|gif|webp|avif|bmp);/.test(cleaned) ||
+            /^data:image\/(?:png|jpe?g|gif|webp|avif|bmp),/.test(cleaned));
+    }
+    return false;
+}
+function stripCssComments(value) {
+    let out = '';
+    let at = 0;
+    for (;;) {
+        const open = value.indexOf('/*', at);
+        const close = open === -1 ? -1 : value.indexOf('*/', open + 2);
+        if (close === -1)
+            return out + value.slice(at);
+        out += value.slice(at, open);
+        at = close + 2;
+    }
+}
+function unescapeCss(value) {
+    return stripCssComments(value
+        .replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_m, hex) => {
+        const code = parseInt(hex, 16);
+        return code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : '�';
+    })
+        .replace(/\\(.)/g, '$1'));
+}
+const DANGEROUS_CSS = /expression\s*\(|javascript\s*:|vbscript\s*:|-moz-binding|behavior\s*:|@import/i;
+function asciiLower(value) {
+    return value.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+}
+function ownsReference(value, prefix) {
+    if (!prefix)
+        return false;
+    return value.split(/\s+/).every((id) => id === '' || id.includes(prefix));
+}
+const URL_REFERENCE = /url\(\s*(['"]?)#([^'")\s]+)\1\s*\)/gi;
+function renameReferences(attribute, value, renames) {
+    const rename = (id) => renames.get(id) ?? id;
+    if (attribute === 'id')
+        return rename(value);
+    if (ID_REFERENCE_ATTRIBUTES.has(attribute))
+        return value.replace(/\S+/g, rename);
+    if (URL_ATTRIBUTES.has(attribute)) {
+        const trimmed = value.trim();
+        return trimmed.startsWith('#') ? `#${rename(trimmed.slice(1))}` : value;
+    }
+    return value.replace(URL_REFERENCE, (match, quote, id) => renames.has(id) ? `url(${quote}#${rename(id)}${quote})` : match);
+}
+function sanitizeAttributes(tag, attrs, opts) {
+    const { prefix, renames, ids } = opts;
+    let out = '';
+    const seen = new Set();
+    for (const { name, value } of attrs) {
+        if (!ATTRIBUTE_NAME.test(name))
+            continue;
+        const lower = name.toLowerCase();
+        if (seen.has(lower))
+            continue;
+        seen.add(lower);
+        if (lower.startsWith('on') || DROPPED_ATTRIBUTES.has(lower))
+            continue;
+        const raw = value === undefined ? undefined : decodeEntities(value).replace(/\u0000/g, '�');
+        if (raw !== undefined && lower === 'id')
+            ids?.push(raw);
+        const decoded = raw === undefined || !renames?.size ? raw : renameReferences(lower, raw, renames);
+        if (decoded !== undefined) {
+            if (URL_ATTRIBUTES.has(lower)) {
+                if ((tag === 'use' || tag === 'feimage') && (lower === 'href' || lower === 'xlink:href')) {
+                    if (!decoded.trim().startsWith('#'))
+                        continue;
+                }
+                const allowDataImage = (tag === 'img' || tag === 'source' || tag === 'image') && lower !== 'xlink:href';
+                if (!isSafeUrl(decoded, { allowDataImage }))
+                    continue;
+            }
+            else if (SRCSET_ATTRIBUTES.has(lower)) {
+                const candidates = decoded.split(',').map((c) => c.trim().split(/\s+/)[0] ?? '');
+                if (!candidates.every((url) => isSafeUrl(url, { allowDataImage: true })))
+                    continue;
+            }
+            else if (lower === 'style') {
+                if (DANGEROUS_CSS.test(unescapeCss(decoded)))
+                    continue;
+            }
+            else if (ID_REFERENCE_ATTRIBUTES.has(lower)) {
+                if (!ownsReference(decoded, prefix))
+                    continue;
+            }
+            else if (lower === 'usemap') {
+                const hash = decoded.indexOf('#');
+                if (hash === -1 || !ownsReference(decoded.slice(hash + 1), prefix))
+                    continue;
+            }
+            else if (lower === 'target') {
+                if (!TARGET_KEYWORDS.has(asciiLower(decoded)))
+                    continue;
+            }
+            else if (lower === 'rel') {
+                if (asciiLower(decoded).split(/\s+/).includes('opener'))
+                    continue;
+            }
+        }
+        out += decoded === undefined ? ` ${name}` : ` ${name}="${escapeAttribute(decoded)}"`;
+    }
+    return out;
+}
+const WHITESPACE = /[\t\n\f\r ]/;
+const TAG_NAME_END = /[\t\n\f\r />]/;
+function parseStartTag(input, start) {
+    let i = start + 1;
+    const n = input.length;
+    let name = '';
+    while (i < n && !TAG_NAME_END.test(input[i]))
+        name += input[i++];
+    const attrs = [];
+    let selfClosing = false;
+    while (i < n) {
+        const c = input[i];
+        if (WHITESPACE.test(c)) {
+            i++;
+            continue;
+        }
+        if (c === '>')
+            return { name, attrs, selfClosing, end: i + 1 };
+        if (c === '/') {
+            selfClosing = input[i + 1] === '>';
+            i++;
+            continue;
+        }
+        selfClosing = false;
+        let attrName = c;
+        i++;
+        while (i < n && !/[\t\n\f\r />=]/.test(input[i]))
+            attrName += input[i++];
+        while (i < n && WHITESPACE.test(input[i]))
+            i++;
+        let value;
+        if (input[i] === '=') {
+            i++;
+            while (i < n && WHITESPACE.test(input[i]))
+                i++;
+            const q = input[i];
+            if (q === '"' || q === "'") {
+                const close = input.indexOf(q, i + 1);
+                if (close === -1)
+                    return undefined;
+                value = input.slice(i + 1, close);
+                i = close + 1;
+            }
+            else {
+                let v = '';
+                while (i < n && !/[\t\n\f\r >]/.test(input[i]))
+                    v += input[i++];
+                value = v;
+            }
+        }
+        attrs.push({ name: attrName, value });
+    }
+    return undefined;
+}
+function findRawTextEnd(input, folded, from, name) {
+    let i = from;
+    for (;;) {
+        const idx = folded.indexOf(`</${name}`, i);
+        if (idx === -1)
+            return -1;
+        const after = input[idx + 2 + name.length];
+        if (after === undefined || TAG_NAME_END.test(after))
+            return idx;
+        i = idx + 1;
+    }
+}
+const COMMENT_END = /--!?>/g;
+export function sanitizeHtml(input, prefix, renames) {
+    return sanitize(input, { prefix, renames });
+}
+function elementIds(html) {
+    const ids = [];
+    sanitize(html, { ids });
+    return ids;
+}
+export function stateIdRenames(first, second, prefix) {
+    const ids = elementIds(first);
+    const owned = (id) => id === '' || id.includes(prefix);
+    if (ids.every(owned))
+        return new Map();
+    const again = second === undefined ? [] : elementIds(second);
+    const stable = new Set(again);
+    const moved = ids.filter((id, i) => !owned(id) && (ids.length === again.length ? again[i] !== id : !stable.has(id)));
+    return new Map(moved.map((id) => [id, `${prefix}${id}`]));
+}
+function sanitize(input, opts) {
+    const src = input.replace(/\u0000/g, '');
+    const folded = asciiLower(src);
+    const n = src.length;
+    let out = '';
+    let i = 0;
+    let dropName;
+    let dropDepth = 0;
+    const emitText = (text) => {
+        if (dropName === undefined && text)
+            out += escapeText(text);
+    };
+    while (i < n) {
+        const lt = src.indexOf('<', i);
+        if (lt === -1) {
+            emitText(src.slice(i));
+            break;
+        }
+        if (lt > i)
+            emitText(src.slice(i, lt));
+        i = lt;
+        const next = src[i + 1];
+        if (src.startsWith('<!--', i)) {
+            let end;
+            let content;
+            if (src.startsWith('<!-->', i)) {
+                end = i + 5;
+                content = '';
+            }
+            else if (src.startsWith('<!--->', i)) {
+                end = i + 6;
+                content = '';
+            }
+            else {
+                COMMENT_END.lastIndex = i + 4;
+                const close = COMMENT_END.exec(src);
+                if (!close)
+                    break;
+                content = src.slice(i + 4, close.index);
+                end = close.index + close[0].length;
+            }
+            if (dropName === undefined && ALLOWED_COMMENT.test(content))
+                out += `<!--${content}-->`;
+            i = end;
+            continue;
+        }
+        if (next === '!' || next === '?') {
+            const close = src.indexOf('>', i);
+            i = close === -1 ? n : close + 1;
+            continue;
+        }
+        if (next === '/') {
+            const first = src[i + 2];
+            if (first !== undefined && /[a-zA-Z]/.test(first)) {
+                let j = i + 2;
+                let name = '';
+                while (j < n && !TAG_NAME_END.test(src[j]))
+                    name += src[j++];
+                const close = src.indexOf('>', j);
+                i = close === -1 ? n : close + 1;
+                const lower = name.toLowerCase();
+                if (dropName !== undefined) {
+                    if (lower === dropName && --dropDepth === 0)
+                        dropName = undefined;
+                    continue;
+                }
+                if (ALLOWED_ELEMENTS.has(lower) && !VOID_ELEMENTS.has(lower))
+                    out += `</${name}>`;
+                continue;
+            }
+            if (first === '>') {
+                i += 3;
+                continue;
+            }
+            const close = src.indexOf('>', i);
+            i = close === -1 ? n : close + 1;
+            continue;
+        }
+        if (next === undefined || !/[a-zA-Z]/.test(next)) {
+            emitText('<');
+            i++;
+            continue;
+        }
+        const tag = parseStartTag(src, i);
+        if (!tag)
+            break;
+        i = tag.end;
+        const lower = tag.name.toLowerCase();
+        if (lower === 'plaintext')
+            break;
+        if (RAW_TEXT.has(lower) && !tag.selfClosing) {
+            const endIdx = findRawTextEnd(src, folded, i, lower);
+            if (endIdx === -1)
+                break;
+            const close = src.indexOf('>', endIdx);
+            i = close === -1 ? n : close + 1;
+            continue;
+        }
+        if (dropName !== undefined) {
+            if (lower === dropName && !tag.selfClosing && !VOID_ELEMENTS.has(lower))
+                dropDepth++;
+            if (RCDATA.has(lower) && !tag.selfClosing) {
+                const endIdx = findRawTextEnd(src, folded, i, lower);
+                const close = endIdx === -1 ? -1 : src.indexOf('>', endIdx);
+                i = close === -1 ? n : close + 1;
+            }
+            continue;
+        }
+        if (DROP_WITH_CONTENT.has(lower)) {
+            if (!tag.selfClosing && !VOID_ELEMENTS.has(lower)) {
+                dropName = lower;
+                dropDepth = 1;
+            }
+            continue;
+        }
+        if (!ALLOWED_ELEMENTS.has(lower))
+            continue;
+        out += `<${tag.name}${sanitizeAttributes(lower, tag.attrs, opts)}${tag.selfClosing ? '/' : ''}>`;
+        if (RCDATA.has(lower) && !tag.selfClosing) {
+            const endIdx = findRawTextEnd(src, folded, i, lower);
+            const content = endIdx === -1 ? src.slice(i) : src.slice(i, endIdx);
+            out += escapeText(content);
+            out += `</${tag.name}>`;
+            if (endIdx === -1)
+                break;
+            const close = src.indexOf('>', endIdx);
+            i = close === -1 ? n : close + 1;
+        }
+    }
+    return out;
+}
+export function sanitizeIslandHtml(input, prefix, renames) {
+    const html = sanitizeHtml(input, prefix, renames);
+    const bytes = new TextEncoder().encode(html).byteLength;
+    if (bytes > MAX_ISLAND_HTML_BYTES)
+        return { tooLarge: true, bytes };
+    return { html, tooLarge: false, bytes };
+}

package/dist/semver.d.ts

@@ -0,0 +1,2 @@
+export declare function majorOf(version: string): number | undefined;
+export declare function satisfies(version: string, range: string): boolean | undefined;

package/dist/semver.js

@@ -0,0 +1,10 @@
+import semver from 'semver';
+export function majorOf(version) {
+    return semver.parse(version.trim(), { loose: true })?.major;
+}
+export function satisfies(version, range) {
+    const parsed = semver.parse(version.trim(), { loose: true });
+    if (!parsed || semver.validRange(range, { loose: true }) === null)
+        return undefined;
+    return semver.satisfies(parsed, range, { loose: true });
+}