@mzebley/mark-down 1.2.2 → 1.2.4

package/README.md

@@ -1,5 +1,6 @@
 # mark↓ Core Runtime
-*(published as `@mzebley/mark-down`)*
+
+_(published as `@mzebley/mark-down`)_
 
 This package provides the framework-agnostic `SnippetClient` and supporting types used to fetch, cache, and render Markdown snippets at runtime. For a monorepo overview visit the [root README](../../README.md).
 
@@ -54,9 +55,14 @@ The client lazily loads the manifest when first needed, then fetches Markdown fi
 - **`cache`** (`boolean`, default `true`) – enable or disable per-snippet and manifest memoisation.
 - **`verbose`** (`boolean`) – log helpful warnings (for example, slug mismatches) during development.
 - **`render`** (`(markdown: string) => string | Promise<string>`) – override the default `marked` renderer when you need custom HTML output.
+- **`sanitize`** (`{ policy?: "default" | "strict" | "permissive"; config?: SanitizeHtmlOptions }`) – optionally sanitize rendered HTML before it is returned.
 
 All options are optional except `manifest`. Results are rendered with `marked` by default; override at the application level if you need a different Markdown pipeline.
 
+`sanitize` is opt-in and uses [`sanitize-html`](https://github.com/apostrophecms/sanitize-html) under the hood. Use the `policy` presets for common Markdown output or override the `config` to tweak allowed tags/attributes.
+
+Security note: mark↓ intentionally allows unsanitized output when `sanitize` is omitted. This is a supported feature for trusted pipelines, but it is unsafe for untrusted content. Enable `sanitize` whenever snippets can be user-generated or externally sourced.
+
 ## Working with snippets
 
 Commonly used APIs:
@@ -80,12 +86,13 @@ import { SnippetClient } from "@mzebley/mark-down";
 
 const client = new SnippetClient({
   manifest: () => import("./snippets-index.json"),
-  fetch: (url) => fetch(url).then((response) => {
-    if (!response.ok) {
-      throw new Error(`Request failed with status ${response.status}`);
-    }
-    return response;
-  }),
+  fetch: (url) =>
+    fetch(url).then((response) => {
+      if (!response.ok) {
+        throw new Error(`Request failed with status ${response.status}`);
+      }
+      return response;
+    }),
 });
 ```
 
@@ -145,11 +152,7 @@ Host the UMD file yourself or load it from a CDN—no build tooling required.
 Write plain Markdown directly in your HTML. The helper finds `[data-markdown]` blocks by default.
 
 ```html
-<div data-markdown>
-# Hello
-
-This is inline markdown with no build step.
-</div>
+<div data-markdown># Hello This is inline markdown with no build step.</div>
 
 <script src="path/to/mark-down-inline.umd.js"></script>
 <script>
@@ -167,16 +170,8 @@ You can optionally prepend YAML front matter to provide metadata for each block.
 
 ```html
 <div data-markdown>
----
-slug: intro
-title: Introduction
-tags: [hero]
-variant: lead
----
-
-# Introduction
-
-This block has metadata.
+  --- slug: intro title: Introduction tags: [hero] variant: lead --- #
+  Introduction This block has metadata.
 </div>
 ```
 
@@ -196,6 +191,7 @@ enhanceInlineMarkdown({
   selector?: string; // defaults to "[data-markdown]"
   processFrontMatter?: boolean; // defaults to true
   applyMetaToDom?: boolean; // defaults to true
+  sanitize?: { policy?: "default" | "strict" | "permissive"; config?: SanitizeHtmlOptions };
 });
 ```
 

package/dist/angular/index.d.ts

@@ -1,6 +1,8 @@
 import { InjectionToken, Provider } from '@angular/core';
 import { Observable } from 'rxjs';
-import { f as SnippetClient, e as SnippetClientOptions, a as Snippet, S as SnippetMeta } from '../snippet-client-CiQX2Zcn.js';
+import { f as SnippetClient, e as SnippetClientOptions, a as Snippet, S as SnippetMeta } from '../snippet-client-S6E_j24g.js';
+import '../sanitize-DI2uKnlG.js';
+import 'sanitize-html';
 
 declare const SNIPPET_CLIENT: InjectionToken<SnippetClient>;
 declare const SNIPPET_CLIENT_OPTIONS: InjectionToken<SnippetClientOptions>;

package/dist/angular/index.js

@@ -1,8 +1,8 @@
 import {
   SnippetClient
-} from "../chunk-35YHML5Z.js";
-import "../chunk-GWLMADTU.js";
-import "../chunk-MWZFQXNW.js";
+} from "../chunk-X5L6GGFF.js";
+import "../chunk-ZEQXN4ZD.js";
+import "../chunk-WZCXKUXV.js";
 import {
   __decorateClass,
   __decorateParam
@@ -11,7 +11,9 @@ import {
 // src/angular/index.ts
 import { Inject, Injectable, InjectionToken } from "@angular/core";
 import { from, map, shareReplay } from "rxjs";
-var SNIPPET_CLIENT = new InjectionToken("@mzebley/mark-down/SNIPPET_CLIENT");
+var SNIPPET_CLIENT = new InjectionToken(
+  "@mzebley/mark-down/SNIPPET_CLIENT"
+);
 var SNIPPET_CLIENT_OPTIONS = new InjectionToken(
   "@mzebley/mark-down/SNIPPET_CLIENT_OPTIONS"
 );
@@ -30,16 +32,24 @@ var MarkdownSnippetService = class {
     this.client = client;
   }
   get(slug) {
-    return from(this.client.get(slug)).pipe(shareReplay({ bufferSize: 1, refCount: true }));
+    return from(this.client.get(slug)).pipe(
+      shareReplay({ bufferSize: 1, refCount: true })
+    );
   }
   listAll() {
-    return from(this.client.listAll()).pipe(shareReplay({ bufferSize: 1, refCount: true }));
+    return from(this.client.listAll()).pipe(
+      shareReplay({ bufferSize: 1, refCount: true })
+    );
   }
   listByGroup(group) {
-    return from(this.client.listByGroup(group)).pipe(shareReplay({ bufferSize: 1, refCount: true }));
+    return from(this.client.listByGroup(group)).pipe(
+      shareReplay({ bufferSize: 1, refCount: true })
+    );
   }
   listByType(type) {
-    return from(this.client.listByType(type)).pipe(shareReplay({ bufferSize: 1, refCount: true }));
+    return from(this.client.listByType(type)).pipe(
+      shareReplay({ bufferSize: 1, refCount: true })
+    );
   }
   html(slug) {
     return this.get(slug).pipe(map((snippet) => snippet.html));

package/dist/angular/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/angular/index.ts"],"sourcesContent":["import { Inject, Injectable, InjectionToken, Provider } from \"@angular/core\";\nimport { from, map, Observable, shareReplay } from \"rxjs\";\nimport { SnippetClient } from \"../snippet-client\";\nimport type { Snippet, SnippetClientOptions, SnippetMeta } from \"../types\";\n\nexport const SNIPPET_CLIENT = new InjectionToken<SnippetClient>(\"@mzebley/mark-down/SNIPPET_CLIENT\");\nexport const SNIPPET_CLIENT_OPTIONS = new InjectionToken<SnippetClientOptions>(\n  \"@mzebley/mark-down/SNIPPET_CLIENT_OPTIONS\"\n);\n\nexport function provideSnippetClient(options: SnippetClientOptions): Provider[] {\n  return [\n    { provide: SNIPPET_CLIENT_OPTIONS, useValue: options },\n    {\n      provide: SNIPPET_CLIENT,\n      useFactory: (opts: SnippetClientOptions) => new SnippetClient(opts),\n      deps: [SNIPPET_CLIENT_OPTIONS]\n    }\n  ];\n}\n\n@Injectable({ providedIn: \"root\" })\nexport class MarkdownSnippetService {\n  constructor(@Inject(SNIPPET_CLIENT) private readonly client: SnippetClient) {}\n\n  get(slug: string): Observable<Snippet> {\n    return from(this.client.get(slug)).pipe(shareReplay({ bufferSize: 1, refCount: true }));\n  }\n\n  listAll(): Observable<SnippetMeta[]> {\n    return from(this.client.listAll()).pipe(shareReplay({ bufferSize: 1, refCount: true }));\n  }\n\n  listByGroup(group: string): Observable<SnippetMeta[]> {\n    return from(this.client.listByGroup(group)).pipe(shareReplay({ bufferSize: 1, refCount: true }));\n  }\n\n  listByType(type: string): Observable<SnippetMeta[]> {\n    return from(this.client.listByType(type)).pipe(shareReplay({ bufferSize: 1, refCount: true }));\n  }\n\n  html(slug: string): Observable<string> {\n    return this.get(slug).pipe(map((snippet) => snippet.html));\n  }\n}\n\nexport type { Snippet, SnippetClientOptions, SnippetMeta } from \"../types\";\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,QAAQ,YAAY,sBAAgC;AAC7D,SAAS,MAAM,KAAiB,mBAAmB;AAI5C,IAAM,iBAAiB,IAAI,eAA8B,mCAAmC;AAC5F,IAAM,yBAAyB,IAAI;AAAA,EACxC;AACF;AAEO,SAAS,qBAAqB,SAA2C;AAC9E,SAAO;AAAA,IACL,EAAE,SAAS,wBAAwB,UAAU,QAAQ;AAAA,IACrD;AAAA,MACE,SAAS;AAAA,MACT,YAAY,CAAC,SAA+B,IAAI,cAAc,IAAI;AAAA,MAClE,MAAM,CAAC,sBAAsB;AAAA,IAC/B;AAAA,EACF;AACF;AAGO,IAAM,yBAAN,MAA6B;AAAA,EAClC,YAAqD,QAAuB;AAAvB;AAAA,EAAwB;AAAA,EAE7E,IAAI,MAAmC;AACrC,WAAO,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,EAAE,KAAK,YAAY,EAAE,YAAY,GAAG,UAAU,KAAK,CAAC,CAAC;AAAA,EACxF;AAAA,EAEA,UAAqC;AACnC,WAAO,KAAK,KAAK,OAAO,QAAQ,CAAC,EAAE,KAAK,YAAY,EAAE,YAAY,GAAG,UAAU,KAAK,CAAC,CAAC;AAAA,EACxF;AAAA,EAEA,YAAY,OAA0C;AACpD,WAAO,KAAK,KAAK,OAAO,YAAY,KAAK,CAAC,EAAE,KAAK,YAAY,EAAE,YAAY,GAAG,UAAU,KAAK,CAAC,CAAC;AAAA,EACjG;AAAA,EAEA,WAAW,MAAyC;AAClD,WAAO,KAAK,KAAK,OAAO,WAAW,IAAI,CAAC,EAAE,KAAK,YAAY,EAAE,YAAY,GAAG,UAAU,KAAK,CAAC,CAAC;AAAA,EAC/F;AAAA,EAEA,KAAK,MAAkC;AACrC,WAAO,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC;AAAA,EAC3D;AACF;AAtBa,yBAAN;AAAA,EADN,WAAW,EAAE,YAAY,OAAO,CAAC;AAAA,EAEnB,0BAAO,cAAc;AAAA,GADvB;","names":[]}
+{"version":3,"sources":["../../src/angular/index.ts"],"sourcesContent":["import { Inject, Injectable, InjectionToken, Provider } from \"@angular/core\";\nimport { from, map, Observable, shareReplay } from \"rxjs\";\nimport { SnippetClient } from \"../snippet-client\";\nimport type { Snippet, SnippetClientOptions, SnippetMeta } from \"../types\";\n\nexport const SNIPPET_CLIENT = new InjectionToken<SnippetClient>(\n  \"@mzebley/mark-down/SNIPPET_CLIENT\",\n);\nexport const SNIPPET_CLIENT_OPTIONS = new InjectionToken<SnippetClientOptions>(\n  \"@mzebley/mark-down/SNIPPET_CLIENT_OPTIONS\",\n);\n\nexport function provideSnippetClient(\n  options: SnippetClientOptions,\n): Provider[] {\n  return [\n    { provide: SNIPPET_CLIENT_OPTIONS, useValue: options },\n    {\n      provide: SNIPPET_CLIENT,\n      useFactory: (opts: SnippetClientOptions) => new SnippetClient(opts),\n      deps: [SNIPPET_CLIENT_OPTIONS],\n    },\n  ];\n}\n\n@Injectable({ providedIn: \"root\" })\nexport class MarkdownSnippetService {\n  constructor(@Inject(SNIPPET_CLIENT) private readonly client: SnippetClient) {}\n\n  get(slug: string): Observable<Snippet> {\n    return from(this.client.get(slug)).pipe(\n      shareReplay({ bufferSize: 1, refCount: true }),\n    );\n  }\n\n  listAll(): Observable<SnippetMeta[]> {\n    return from(this.client.listAll()).pipe(\n      shareReplay({ bufferSize: 1, refCount: true }),\n    );\n  }\n\n  listByGroup(group: string): Observable<SnippetMeta[]> {\n    return from(this.client.listByGroup(group)).pipe(\n      shareReplay({ bufferSize: 1, refCount: true }),\n    );\n  }\n\n  listByType(type: string): Observable<SnippetMeta[]> {\n    return from(this.client.listByType(type)).pipe(\n      shareReplay({ bufferSize: 1, refCount: true }),\n    );\n  }\n\n  html(slug: string): Observable<string> {\n    return this.get(slug).pipe(map((snippet) => snippet.html));\n  }\n}\n\nexport type { Snippet, SnippetClientOptions, SnippetMeta } from \"../types\";\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,QAAQ,YAAY,sBAAgC;AAC7D,SAAS,MAAM,KAAiB,mBAAmB;AAI5C,IAAM,iBAAiB,IAAI;AAAA,EAChC;AACF;AACO,IAAM,yBAAyB,IAAI;AAAA,EACxC;AACF;AAEO,SAAS,qBACd,SACY;AACZ,SAAO;AAAA,IACL,EAAE,SAAS,wBAAwB,UAAU,QAAQ;AAAA,IACrD;AAAA,MACE,SAAS;AAAA,MACT,YAAY,CAAC,SAA+B,IAAI,cAAc,IAAI;AAAA,MAClE,MAAM,CAAC,sBAAsB;AAAA,IAC/B;AAAA,EACF;AACF;AAGO,IAAM,yBAAN,MAA6B;AAAA,EAClC,YAAqD,QAAuB;AAAvB;AAAA,EAAwB;AAAA,EAE7E,IAAI,MAAmC;AACrC,WAAO,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,EAAE;AAAA,MACjC,YAAY,EAAE,YAAY,GAAG,UAAU,KAAK,CAAC;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,UAAqC;AACnC,WAAO,KAAK,KAAK,OAAO,QAAQ,CAAC,EAAE;AAAA,MACjC,YAAY,EAAE,YAAY,GAAG,UAAU,KAAK,CAAC;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,YAAY,OAA0C;AACpD,WAAO,KAAK,KAAK,OAAO,YAAY,KAAK,CAAC,EAAE;AAAA,MAC1C,YAAY,EAAE,YAAY,GAAG,UAAU,KAAK,CAAC;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,WAAW,MAAyC;AAClD,WAAO,KAAK,KAAK,OAAO,WAAW,IAAI,CAAC,EAAE;AAAA,MACxC,YAAY,EAAE,YAAY,GAAG,UAAU,KAAK,CAAC;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,KAAK,MAAkC;AACrC,WAAO,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC;AAAA,EAC3D;AACF;AA9Ba,yBAAN;AAAA,EADN,WAAW,EAAE,YAAY,OAAO,CAAC;AAAA,EAEnB,0BAAO,cAAc;AAAA,GADvB;","names":[]}

package/dist/browser.js

@@ -8,7 +8,9 @@ function normalizeSlug(input) {
   }
   const normalized = value.toLowerCase().replace(NON_ALPHANUMERIC, "-").replace(/-{2,}/g, "-").replace(LEADING_TRAILING_DASH, "");
   if (!normalized) {
-    throw new Error(`Slug '${input}' does not contain any alphanumeric characters`);
+    throw new Error(
+      `Slug '${input}' does not contain any alphanumeric characters`
+    );
   }
   return normalized;
 }
@@ -47,7 +49,12 @@ function parseFrontMatter(raw) {
     throw new ManifestLoadError("Failed to parse snippet front-matter.", error);
   }
   if (!isRecord(data)) {
-    return { content: raw.slice(match[0].length), meta: {}, extra: {}, hasFrontMatter: true };
+    return {
+      content: raw.slice(match[0].length),
+      meta: {},
+      extra: {},
+      hasFrontMatter: true
+    };
   }
   const { known, extra } = splitFrontMatter(data);
   return {
@@ -128,13 +135,134 @@ function renderMarkdown(markdown) {
   throw new Error("renderMarkdown unexpectedly returned a Promise");
 }
 
+// src/sanitize.ts
+import sanitizeHtml from "sanitize-html";
+var DEFAULT_ALLOWED_TAGS = [
+  "a",
+  "b",
+  "blockquote",
+  "br",
+  "code",
+  "del",
+  "em",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "hr",
+  "i",
+  "img",
+  "li",
+  "ol",
+  "p",
+  "pre",
+  "span",
+  "strong",
+  "sub",
+  "sup",
+  "table",
+  "tbody",
+  "td",
+  "th",
+  "thead",
+  "tr",
+  "ul"
+];
+var STRICT_ALLOWED_TAGS = [
+  "a",
+  "blockquote",
+  "br",
+  "code",
+  "em",
+  "li",
+  "ol",
+  "p",
+  "pre",
+  "strong",
+  "ul"
+];
+var DEFAULT_ALLOWED_ATTRIBUTES = {
+  a: ["href", "name", "target", "rel"],
+  img: ["src", "alt", "title", "width", "height"],
+  code: ["class"],
+  pre: ["class"],
+  span: ["class"],
+  "*": ["id", "title", "aria-*", "data-*"]
+};
+var STRICT_ALLOWED_ATTRIBUTES = {
+  a: ["href", "name", "target", "rel"]
+};
+var POLICY_CONFIG = {
+  default: {
+    allowedTags: DEFAULT_ALLOWED_TAGS,
+    allowedAttributes: DEFAULT_ALLOWED_ATTRIBUTES,
+    allowedSchemes: ["http", "https", "mailto"],
+    allowedSchemesByTag: {
+      img: ["http", "https", "data"]
+    }
+  },
+  strict: {
+    allowedTags: STRICT_ALLOWED_TAGS,
+    allowedAttributes: STRICT_ALLOWED_ATTRIBUTES,
+    allowedSchemes: ["http", "https", "mailto"]
+  },
+  permissive: {
+    ...sanitizeHtml.defaults,
+    allowedTags: sanitizeHtml.defaults.allowedTags ? [...sanitizeHtml.defaults.allowedTags] : void 0,
+    allowedAttributes: sanitizeHtml.defaults.allowedAttributes ? { ...sanitizeHtml.defaults.allowedAttributes } : void 0
+  }
+};
+function sanitizeMarkup(html, options = {}) {
+  const policy = options.policy ?? "default";
+  const base = POLICY_CONFIG[policy];
+  const merged = mergeOptions(base, options.config);
+  return sanitizeHtml(html, merged);
+}
+function mergeOptions(base, overrides) {
+  if (!overrides) {
+    return base;
+  }
+  return {
+    ...base,
+    ...overrides,
+    allowedAttributes: mergeAllowedAttributes(
+      base.allowedAttributes,
+      overrides.allowedAttributes
+    ),
+    allowedClasses: mergeRecord(base.allowedClasses, overrides.allowedClasses),
+    allowedStyles: mergeRecord(base.allowedStyles, overrides.allowedStyles)
+  };
+}
+function mergeAllowedAttributes(base, overrides) {
+  if (overrides === false) {
+    return false;
+  }
+  if (base === false) {
+    return overrides ?? false;
+  }
+  if (!base && !overrides) {
+    return void 0;
+  }
+  return { ...base ?? {}, ...overrides ?? {} };
+}
+function mergeRecord(base, overrides) {
+  if (!base && !overrides) {
+    return void 0;
+  }
+  return { ...base ?? {}, ...overrides ?? {} };
+}
+
 // src/snippet-client.ts
 var HTTP_PATTERN = /^https?:\/\//i;
 var SnippetClient = class {
   constructor(options) {
     this.snippetCache = /* @__PURE__ */ new Map();
     if (!options || !options.manifest) {
-      throw new ManifestLoadError("A manifest source must be provided to SnippetClient.");
+      throw new ManifestLoadError(
+        "A manifest source must be provided to SnippetClient."
+      );
     }
     this.manifestUrl = typeof options.manifest === "string" ? options.manifest : void 0;
     this.inferredBase = this.manifestUrl ? deriveBaseFromManifest(this.manifestUrl) : void 0;
@@ -154,7 +282,8 @@ var SnippetClient = class {
       frontMatter: options.frontMatter !== false,
       cache: options.cache !== false,
       verbose: options.verbose === true,
-      render: renderer
+      render: renderer,
+      sanitize: options.sanitize
     };
   }
   async get(slug) {
@@ -231,7 +360,9 @@ var SnippetClient = class {
       } else if (typeof source === "function") {
         const result = await source();
         if (!Array.isArray(result)) {
-          throw new ManifestLoadError("Manifest loader must resolve to an array of snippet metadata.");
+          throw new ManifestLoadError(
+            "Manifest loader must resolve to an array of snippet metadata."
+          );
         }
         entries = result.map(normalizeManifestEntry);
       } else {
@@ -263,11 +394,17 @@ var SnippetClient = class {
     try {
       raw = await this.options.fetch(url);
     } catch (error) {
-      throw new ManifestLoadError(`Failed to fetch snippet at '${url}'.`, error);
+      throw new ManifestLoadError(
+        `Failed to fetch snippet at '${url}'.`,
+        error
+      );
     }
     const frontMatter = this.options.frontMatter ? parseFrontMatter(raw) : void 0;
     const body = frontMatter?.content ?? raw;
-    const html = await this.options.render(body);
+    let html = await this.options.render(body);
+    if (this.options.sanitize) {
+      html = sanitizeMarkup(html, this.options.sanitize);
+    }
     const merged = {
       ...meta,
       ...pickMeta(frontMatter?.meta),
@@ -283,7 +420,10 @@ var SnippetClient = class {
         }
       } catch (error) {
         if (this.options.verbose) {
-          console.warn(`Failed to normalize front-matter slug '${frontMatter.slug}':`, error);
+          console.warn(
+            `Failed to normalize front-matter slug '${frontMatter.slug}':`,
+            error
+          );
         }
       }
     }
@@ -315,26 +455,38 @@ function parseManifest(raw, source) {
   try {
     parsed = JSON.parse(raw);
   } catch (error) {
-    throw new ManifestLoadError(`Manifest at '${source}' is not valid JSON.`, error);
+    throw new ManifestLoadError(
+      `Manifest at '${source}' is not valid JSON.`,
+      error
+    );
   }
   if (!Array.isArray(parsed)) {
-    throw new ManifestLoadError(`Manifest at '${source}' must be a JSON array.`);
+    throw new ManifestLoadError(
+      `Manifest at '${source}' must be a JSON array.`
+    );
   }
   return parsed;
 }
 function normalizeManifestEntry(entry) {
+  if (!entry || typeof entry !== "object") {
+    throw new ManifestLoadError("Manifest entry must be an object.");
+  }
   if (!entry.slug) {
-    throw new ManifestLoadError("Manifest entry is missing required 'slug' property.");
+    throw new ManifestLoadError(
+      "Manifest entry is missing required 'slug' property."
+    );
   }
   if (!entry.path) {
-    throw new ManifestLoadError(`Manifest entry for '${entry.slug}' is missing required 'path'.`);
+    throw new ManifestLoadError(
+      `Manifest entry for '${entry.slug}' is missing required 'path'.`
+    );
   }
   const normalized = {
     slug: entry.slug,
     title: entry.title,
     type: entry.type,
     order: entry.order,
-    tags: entry.tags ? [...entry.tags] : void 0,
+    tags: normalizeTags2(entry.tags),
     path: normalizeForwardSlashes(entry.path),
     group: entry.group ?? null,
     draft: entry.draft,
@@ -372,21 +524,22 @@ function joinPaths(base, relative) {
   return normalizeForwardSlashes(`${leading}${trimmed}`);
 }
 function normalizeForwardSlashes(value) {
-  if (HTTP_PATTERN.test(value)) {
+  const sanitized = value.replace(/\\/g, "/");
+  if (HTTP_PATTERN.test(sanitized)) {
     try {
-      const url = new URL(value);
+      const url = new URL(sanitized);
       url.pathname = url.pathname.replace(/\/{2,}/g, "/");
       return url.toString();
     } catch {
     }
   }
-  if (value.startsWith("//")) {
-    return `//${value.slice(2).replace(/\/{2,}/g, "/")}`;
+  if (sanitized.startsWith("//")) {
+    return `//${sanitized.slice(2).replace(/\/{2,}/g, "/")}`;
   }
-  if (value.startsWith("/")) {
-    return `/${value.slice(1).replace(/\/{2,}/g, "/")}`;
+  if (sanitized.startsWith("/")) {
+    return `/${sanitized.slice(1).replace(/\/{2,}/g, "/")}`;
   }
-  return value.replace(/\/{2,}/g, "/");
+  return sanitized.replace(/\/{2,}/g, "/");
 }
 function mergeExtra(base, overrides) {
   if (!base && !overrides) {
@@ -403,20 +556,36 @@ function cloneRecord(value) {
 function cloneMeta(meta) {
   return {
     ...meta,
-    tags: meta.tags ? [...meta.tags] : void 0,
+    tags: normalizeTags2(meta.tags),
     extra: cloneRecord(meta.extra)
   };
 }
+function normalizeTags2(value) {
+  if (!value) {
+    return void 0;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => String(entry));
+  }
+  if (typeof value === "string") {
+    return value.split(",").map((entry) => entry.trim()).filter(Boolean);
+  }
+  return void 0;
+}
 async function defaultFetch(url) {
   const runtimeFetch = globalThis.fetch;
   if (!runtimeFetch) {
-    throw new ManifestLoadError("No global fetch implementation is available. Provide a custom fetch function.");
+    throw new ManifestLoadError(
+      "No global fetch implementation is available. Provide a custom fetch function."
+    );
   }
   return runtimeFetch(url);
 }
 async function resolveResponseText(response, url) {
   if (!response.ok) {
-    throw new ManifestLoadError(`Request to '${url}' failed with status ${response.status}.`);
+    throw new ManifestLoadError(
+      `Request to '${url}' failed with status ${response.status}.`
+    );
   }
   return response.text();
 }
@@ -470,7 +639,12 @@ function installBufferShim() {
       }
       if (ArrayBuffer.isView(value)) {
         super(
-          new Uint8Array(value.buffer.slice(value.byteOffset, value.byteOffset + value.byteLength))
+          new Uint8Array(
+            value.buffer.slice(
+              value.byteOffset,
+              value.byteOffset + value.byteLength
+            )
+          )
         );
         return;
       }
@@ -478,7 +652,9 @@ function installBufferShim() {
     }
     toString(encoding = "utf-8") {
       if (encoding !== "utf-8" && encoding !== "utf8") {
-        throw new Error(`Unsupported encoding '${encoding}' in browser Buffer shim`);
+        throw new Error(
+          `Unsupported encoding '${encoding}' in browser Buffer shim`
+        );
       }
       return textDecoder.decode(this);
     }
@@ -486,7 +662,9 @@ function installBufferShim() {
   const from = (value, encoding = "utf-8") => {
     if (typeof value === "string") {
       if (encoding !== "utf-8" && encoding !== "utf8") {
-        throw new Error(`Unsupported encoding '${encoding}' in browser Buffer shim`);
+        throw new Error(
+          `Unsupported encoding '${encoding}' in browser Buffer shim`
+        );
       }
       return new BrowserBuffer(textEncoder.encode(value));
     }
@@ -499,7 +677,9 @@ function installBufferShim() {
     if (typeof value.length === "number") {
       return new BrowserBuffer(Array.from(value));
     }
-    throw new TypeError("Unsupported input passed to Buffer.from in browser shim");
+    throw new TypeError(
+      "Unsupported input passed to Buffer.from in browser shim"
+    );
   };
   const alloc = (size, fill) => {
     if (size < 0) {
@@ -528,11 +708,19 @@ function installBufferShim() {
       (buffer) => buffer instanceof BrowserBuffer ? buffer : new BrowserBuffer(buffer)
     );
     const length = totalLength ?? sanitized.reduce((acc, current) => acc + current.length, 0);
+    if (length < 0) {
+      throw new RangeError("Invalid Buffer length");
+    }
     const result = new BrowserBuffer(length);
     let offset = 0;
     for (const buffer of sanitized) {
-      result.set(buffer, offset);
-      offset += buffer.length;
+      const remaining = length - offset;
+      if (remaining <= 0) {
+        break;
+      }
+      const slice = buffer.length > remaining ? buffer.subarray(0, remaining) : buffer;
+      result.set(slice, offset);
+      offset += slice.length;
     }
     return result;
   };
@@ -550,7 +738,9 @@ function installBufferShim() {
   };
   Object.defineProperties(BrowserBuffer, {
     from: { value: from },
-    isBuffer: { value: (candidate) => candidate instanceof BrowserBuffer },
+    isBuffer: {
+      value: (candidate) => candidate instanceof BrowserBuffer
+    },
     alloc: { value: alloc },
     concat: { value: concat },
     byteLength: { value: byteLength }
@@ -575,6 +765,7 @@ export {
   SnippetNotFoundError,
   normalizeSlug,
   parseFrontMatter,
-  renderMarkdown
+  renderMarkdown,
+  sanitizeMarkup
 };
 //# sourceMappingURL=browser.js.map