@primeui-devkit/markdown-core 0.1.0-rc.2 → 0.1.0-rc.4

package/README.md

@@ -1,92 +1,18 @@
 # @primeui-devkit/markdown-core
 
-Framework-agnostic markdown engine. Parses markdown with component directives
-(`::name{props}`) into a serializable AST that every `*-markdown` renderer consumes.
+Framework-agnostic markdown engine: parses markdown with component directives into a serializable tree that every renderer consumes, plus highlighting, search and llms.txt helpers.
 
-```ts
-import { createDocsParser } from '@primeui-devkit/markdown-core/preset';
-
-const parse = createDocsParser(); // headings + toc + alert + binding
-const tree = await parse('# Hello\n\n::demo-viewer{name="basic"}\n::');
-// the tree is plain JSON — cacheable, serializable, consumable by any renderer
-```
-
-Parsing is asynchronous — plugins may load resources — so the result has to be awaited
-before any of the tree helpers below will accept it.
-
-Lower-level API: `createMarkdownParser`, `parseMarkdown`, `defineMarkdownPlugin`.
-Optional plugins as subpaths: `./plugins/{headings,toc,highlight,alert,binding}`
-(highlight needs the optional `shiki` peer).
-
-Types: `MarkdownTree`, `MarkdownNode`, `MarkdownElement`, `MarkdownPlugin`, `MarkdownParser`.
-
-## Syntax highlighting
-
-The preset deliberately leaves highlighting out. A highlighter is heavy and not every page
-needs one, so it ships as an optional peer:
+## Install
 
 ```bash
-pnpm add shiki
+pnpm add @primeui-devkit/markdown-core
 ```
 
-Install it before importing `./plugins/highlight`. Without it that import fails while the
-module is still loading, with `Cannot find package 'shiki'` raised from inside the parsing
-backend — the message names neither this package nor the missing peer, and no `try` around
-the import can catch it.
-
-Highlighting is asynchronous, so it runs as its own step after parsing rather than inside
-it:
+## Use
 
 ```ts
 import { createDocsParser } from '@primeui-devkit/markdown-core/preset';
-import { highlightTree } from '@primeui-devkit/markdown-core/plugins/highlight';
 
 const parse = createDocsParser();
-const tree = await highlightTree(await parse(source));
-```
-
-Both themes are emitted at once, so a page switches between light and dark without
-highlighting anything again.
-
-Passing a theme name the backend does not know produces unhighlighted output without
-reporting anything, so `highlightTree` checks names first and throws with the list of what
-is available — `availableThemes()` returns the same list.
-
-```ts
-await highlightTree(tree, { themes: { light: 'material-theme-lighter', dark: 'material-theme-palenight' } });
-```
-
-A theme the backend does not ship is passed as a definition instead of a name. `languages`
-preloads grammars, which keeps a build to the ones it uses rather than loading every one on
-demand, and `transformers` is where line markers such as `[!code highlight]` come from.
-
-```ts
-import { transformerNotationHighlight } from '@shikijs/transformers';
-
-await highlightTree(tree, {
-    themes: { light: (await import('shiki/themes/github-light.mjs')).default, dark: 'material-theme-palenight' },
-    languages: [(await import('shiki/langs/vue.mjs')).default],
-    transformers: [transformerNotationHighlight()]
-});
-```
-
-`@primeui-devkit/highlighter` is a separate package for highlighting a standalone snippet
-to HTML. Neither depends on the other: this one works on a parsed tree, that one on a
-string, and a repository takes whichever it needs.
-
-## Content utilities
-
-Parser-free subpaths for tooling and pipelines — usable in Node scripts, build
-steps, and browsers without pulling the engine in:
-
-- `./tree` — `tocFromTree`, `titleFromTree`, `descriptionFromTree`, `walkTree`, `textOf`, `headingSections`, node helpers (`isElement`, `tagOf`, `propsOf`, `childrenOf`)
-- `./search` — `buildSearchIndex(pages)` → heading-level `SearchDocument[]` (feed a local search, Algolia, or an agent) and `searchDocuments(index, query)` — a dependency-free scorer for docs-sized corpora
-- `./llms` — `renderLlmsIndex`, `renderLlmsFull`, `rawMarkdownFiles` for llms.txt pipelines
-
-```ts
-import { buildSearchIndex } from '@primeui-devkit/markdown-core/search';
-import { renderLlmsIndex } from '@primeui-devkit/markdown-core/llms';
-
-const index = buildSearchIndex(pages.map((p) => ({ route: p.route, tree: p.tree })));
-const llms = renderLlmsIndex(pages, { title: 'Docs', siteUrl: 'https://docs.example.dev' });
+const tree = await parse('# Hello\n\n::demo-viewer{name="basic"}\n::');
 ```

package/THIRD-PARTY-NOTICES.txt

@@ -5,11 +5,11 @@ Each is provided under its own license, reproduced below.
 
 ---
 
-## comark
+## comark 0.5.1
 
 Copyright (c) 2026 Comark team and contributors
 
-The markdown parsing engine used by this package (https://github.com/comarkdown/comark).
+https://comark.dev
 
 Licensed under the MIT License.
 

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export { ComarkElement as MarkdownElement, ComarkNode as MarkdownNode, ParseOptions as MarkdownParseOptions, ComarkParseFn as MarkdownParser, ComarkPlugin as MarkdownPlugin, NodeRenderData as MarkdownRenderData, ComarkTree as MarkdownTree, autoCloseMarkdown, createParse as createMarkdownParser, defineComarkPlugin as defineMarkdownPlugin, parseFrontmatter, parse as parseMarkdown } from 'comark';
 export { pascalCase, resolveAttributes } from 'comark/utils';
 export { HeadingSection, TocItem, childrenOf, descriptionFromTree, headingSections, isElement, propsOf, tagOf, textOf, titleFromTree, tocFromTree, walkTree } from './tree.js';
+export { SanitizeOptions, componentMap, defaultAllowedProtocols, defaultBlockedTags, isPrototypeKey, isSafeAttribute, sanitizeOptions, sanitizeTree } from './plugins/sanitize.js';

package/dist/index.js

@@ -1 +1 @@
-export{autoCloseMarkdown,createParse as createMarkdownParser,defineComarkPlugin as defineMarkdownPlugin,parseFrontmatter,parse as parseMarkdown}from'comark';export{pascalCase,resolveAttributes}from'comark/utils';function u(e){return e?.meta?.toc?.links??[]}function f(e){return String(e?.frontmatter?.title??e?.meta?.title??"")}function l(e){return String(e?.frontmatter?.description??"")}function a(e){return Array.isArray(e)}function d(e){return e[0]}function m(e){return e[1]??{}}function s(e){return e.slice(2)}function w(e,t){let n=(r,o)=>{if(!(t(r,o)===false||!a(r)))for(let k of s(r))n(k,r);};for(let r of e.nodes??[])n(r,null);}function i(e){return typeof e=="string"?e:Array.isArray(e)&&typeof e[0]!="string"?e.map(t=>i(t)).join(""):a(e)?s(e).map(t=>i(t)).join(""):""}var c=new Set(["h1","h2","h3","h4","h5","h6"]);function p(e){let t=[],n={id:"",heading:"",depth:0,text:""};for(let r of e.nodes??[]){if(a(r)&&c.has(d(r))){(n.text.trim()||n.heading)&&t.push(n),n={id:String(m(r).id??""),heading:i(r),depth:Number(d(r).slice(1)),text:""};continue}if(a(r)&&d(r)==="pre")continue;let o=i(r).trim();o&&(n.text+=(n.text?" ":"")+o);}return (n.text.trim()||n.heading)&&t.push(n),t}export{s as childrenOf,l as descriptionFromTree,p as headingSections,a as isElement,m as propsOf,d as tagOf,i as textOf,f as titleFromTree,u as tocFromTree,w as walkTree};
+import{childrenOf as e,descriptionFromTree as t,headingSections as n,isElement as r,propsOf as i,tagOf as a,textOf as o,titleFromTree as s,tocFromTree as c,walkTree as l}from"./tree.js";import{componentMap as u,defaultAllowedProtocols as d,defaultBlockedTags as f,isPrototypeKey as p,isSafeAttribute as m,sanitizeOptions as h,sanitizeTree as g}from"./plugins/sanitize.js";import{autoCloseMarkdown as _,createParse as v,defineComarkPlugin as y,parse as b,parseFrontmatter as x}from"comark";import{pascalCase as S,resolveAttributes as C}from"comark/utils";export{_ as autoCloseMarkdown,e as childrenOf,u as componentMap,v as createMarkdownParser,d as defaultAllowedProtocols,f as defaultBlockedTags,y as defineMarkdownPlugin,t as descriptionFromTree,n as headingSections,r as isElement,p as isPrototypeKey,m as isSafeAttribute,x as parseFrontmatter,b as parseMarkdown,S as pascalCase,i as propsOf,C as resolveAttributes,h as sanitizeOptions,g as sanitizeTree,a as tagOf,o as textOf,s as titleFromTree,c as tocFromTree,l as walkTree};

package/dist/llms.d.ts

@@ -3,9 +3,9 @@ interface LlmsPage {
     route: string;
     /** Raw markdown source of the page. */
     markdown: string;
-    /** Optional explicit title; defaults to the first `# ` heading. */
+    /** Explicit title; defaults to the first `# ` heading. */
     title?: string;
-    /** Optional one-line description, appended to index links and full sections. */
+    /** One-line description, appended to index links and full sections. */
     description?: string;
 }
 interface LlmsIndexOptions {
@@ -15,11 +15,7 @@ interface LlmsIndexOptions {
     description?: string;
     /** Absolute origin used in links, e.g. 'https://vue.example.dev'. */
     siteUrl: string;
-    /**
-     * How each link points at a page, given its route:
-     * - 'page' (default): `${siteUrl}/${route}`
-     * - 'raw': `${siteUrl}/raw/${route}.md`
-     */
+    /** Link target: 'page' (default) is `${siteUrl}/${route}`, 'raw' is `${siteUrl}/raw/${route}.md`. */
     linkTarget?: 'page' | 'raw';
     /** Heading above the link list. @default 'Documentation' */
     heading?: string;
@@ -33,13 +29,14 @@ interface LlmsFullOptions {
     transform?: (page: LlmsPage) => string;
 }
 declare function pageTitle(page: LlmsPage): string;
-/** llms.txt — the index document: site summary plus one link per page. */
+/** Renders llms.txt: site summary plus one link per page. */
 declare function renderLlmsIndex(pages: LlmsPage[], options: LlmsIndexOptions): string;
-/** llms-full.txt — every page's markdown concatenated into one document. */
+/** Renders llms-full.txt: every page's markdown in one document. */
 declare function renderLlmsFull(pages: LlmsPage[], options: LlmsFullOptions): string;
 /** File plan for the raw markdown mirror: [route, content]. */
 declare function rawMarkdownFiles(pages: LlmsPage[], options?: {
     transform?: (page: LlmsPage) => string;
 }): Array<[string, string]>;
 
-export { type LlmsFullOptions, type LlmsIndexOptions, type LlmsPage, pageTitle, rawMarkdownFiles, renderLlmsFull, renderLlmsIndex };
+export { pageTitle, rawMarkdownFiles, renderLlmsFull, renderLlmsIndex };
+export type { LlmsFullOptions, LlmsIndexOptions, LlmsPage };

package/dist/llms.js

@@ -1,9 +1,4 @@
-function i(t){return t.title??t.markdown.match(/^#\s+(.+)$/m)?.[1]??t.route}function l(t,r){let e=t.route.replace(/^\//,"");return r.linkTarget==="raw"?`${r.siteUrl}/raw/${e}.md`:`${r.siteUrl}/${e}`}function a(t,r){return [`# ${r.title}`,"",`> ${r.description??""}`,"",`## ${r.heading??"Documentation"}`,...t.map(n=>`- [${i(n)}](${l(n,r)})${n.description?`: ${n.description}`:""}`)].join(`
-`)}function m(t,r){return [`# ${r.title}`,"",`> ${r.description??""}`,"",...t.map(n=>{let s=r.transform?r.transform(n):n.markdown.trim();return `## ${i(n)}
+function e(e){return e.title??e.markdown.replace(/```[\s\S]*?```/g,``).match(/^#\s+(.+)$/m)?.[1]??e.route}function t(e,t){let n=e.route.replace(/^\//,``);return t.linkTarget===`raw`?`${t.siteUrl}/raw/${n}.md`:`${t.siteUrl}/${n}`}function n(n,r){return[`# ${r.title}`,``,`> ${r.description??``}`,``,`## ${r.heading??`Documentation`}`,...n.map(n=>`- [${e(n)}](${t(n,r)})${n.description?`: ${n.description}`:``}`)].join(`
+`)}function r(t,n){return[`# ${n.title}`,``,`> ${n.description??``}`,``,...t.map(t=>{let r=n.transform?n.transform(t):t.markdown.trim();return`## ${e(t)}\n\n${t.description?`${t.description}\n\n`:``}${r}`})].join(`
 
-${n.description?`${n.description}
-
-`:""}${s}`})].join(`
-
-`)}function o(t,r){return t.map(e=>[e.route.replace(/^\//,""),r?.transform?r.transform(e):e.markdown])}
-export{i as pageTitle,o as rawMarkdownFiles,m as renderLlmsFull,a as renderLlmsIndex};
+`)}function i(e,t){return e.map(e=>[e.route.replace(/^\//,``),t?.transform?t.transform(e):e.markdown])}export{e as pageTitle,i as rawMarkdownFiles,r as renderLlmsFull,n as renderLlmsIndex};

package/dist/plugins/alert.js

@@ -1 +1 @@
-export*from'comark/plugins/alert';export{default}from'comark/plugins/alert';
+import e from"comark/plugins/alert";export*from"comark/plugins/alert";export{e as default};

package/dist/plugins/binding.js

@@ -1 +1 @@
-export*from'comark/plugins/binding';export{default}from'comark/plugins/binding';
+import e from"comark/plugins/binding";export*from"comark/plugins/binding";export{e as default};

package/dist/plugins/headings.js

@@ -1 +1 @@
-export*from'comark/plugins/headings';export{default}from'comark/plugins/headings';
+import e from"comark/plugins/headings";export*from"comark/plugins/headings";export{e as default};

package/dist/plugins/highlight.d.ts

@@ -1,30 +1,6 @@
 import { ComarkPlugin, ComarkTree } from 'comark';
 
-/**
- * NOTE ON THE OPTIONAL PEER — importing this subpath without `shiki` installed fails at
- * module load with `Cannot find package 'shiki'`, thrown from inside the backend rather
- * than from here. That cannot be caught: the failing import is the static one above, which
- * runs before any code in this file. Making it dynamic would push the cost onto every
- * caller and would still not help {@link default}, which is synchronous by contract.
- *
- * So the message stays as it is, and the requirement is documented instead: the README and
- * the package's `peerDependenciesMeta` both state that highlighting needs `shiki`.
- */
-/**
- * Syntax highlighting for code blocks.
- *
- * The options below are this package's own. The backend exposes the highlighting engine's
- * types directly — themes, language registrations, transformers — and re-exporting those
- * would tie every caller to that engine through a package whose whole purpose is to keep
- * it out of sight.
- */
-/**
- * A theme, either by name or as a full definition.
- *
- * The definition form is deliberately opaque: describing it would pull the highlighting
- * engine's types into this package's public surface, which is what it exists to avoid.
- * Pass the value a `shiki/themes/*` module default-exports.
- */
+/** A theme name, or a definition as a `shiki/themes/*` module default-exports. */
 type HighlightTheme = string | (object & {
     name?: string;
 });
@@ -33,27 +9,14 @@ type HighlightLanguage = object;
 /** A code-block transformer, as `@shikijs/transformers` returns. */
 type HighlightTransformer = object;
 interface HighlightOptions {
-    /**
-     * Themes to render with. Both are emitted, so a page can switch between light and dark
-     * without highlighting anything again.
-     *
-     * A registered name works, as does a theme definition — pass the latter to use a theme
-     * the backend does not ship. Names are checked first, because a name the backend does
-     * not know leaves every block unhighlighted without reporting anything.
-     */
+    /** Light and dark themes, both emitted. Unknown theme names throw. */
     themes?: {
         light: HighlightTheme;
         dark: HighlightTheme;
     };
-    /**
-     * Languages to preload. Left unset, languages load on demand, which needs the backend's
-     * full bundle; preloading keeps a build to the grammars it actually uses.
-     */
+    /** Languages to preload. Unset loads them on demand from the full bundle. */
     languages?: HighlightLanguage[];
-    /**
-     * Transformers applied to every block — line markers such as `[!code highlight]` come
-     * from these.
-     */
+    /** Transformers applied to every block, e.g. for `[!code highlight]` markers. */
     transformers?: HighlightTransformer[];
     /** Whether to inline the theme's background and colour on the block. Defaults to `false`. */
     inlineStyles?: boolean;
@@ -66,9 +29,7 @@ declare const defaultThemes: {
 /** Themes available without registering any of your own. */
 declare function availableThemes(): Promise<string[]>;
 /**
- * Highlight every code block in a parsed tree.
- *
- * Highlighting is asynchronous and happens after parsing, so it runs as its own step:
+ * Highlight every code block in a parsed tree, as an async step after parsing.
  *
  * @example
  * ```ts
@@ -80,13 +41,8 @@ declare function availableThemes(): Promise<string[]>;
  * ```
  */
 declare function highlightTree(tree: ComarkTree, options?: HighlightOptions): Promise<ComarkTree>;
-/**
- * The same highlighting as a parser plugin.
- *
- * Kept for parsers that drive the plugin pipeline themselves. Prefer {@link highlightTree}:
- * the plugin form marks blocks as highlighted without tokenising them, because tokenising
- * is asynchronous and the plugin hook is not.
- */
+/** Parser plugin form: tokenises every block while parsing. {@link highlightTree} does the same for a tree parsed earlier or cached. */
 declare function highlight(options?: HighlightOptions): ComarkPlugin<any, any>;
 
-export { type HighlightLanguage, type HighlightOptions, type HighlightTheme, type HighlightTransformer, availableThemes, highlight as default, defaultThemes, highlightTree };
+export { availableThemes, highlight as default, defaultThemes, highlightTree };
+export type { HighlightLanguage, HighlightOptions, HighlightTheme, HighlightTransformer };

package/dist/plugins/highlight.js

@@ -1 +1 @@
-import l,{getHighlighter,highlightCodeBlocks}from'comark/plugins/highlight';var c=e=>e?[e.light,e.dark].filter(t=>typeof t=="string"):[],y={light:"material-theme-lighter",dark:"material-theme-palenight"};async function d(){return (await getHighlighter()).getLoadedThemes?.()??[]}async function T(e,t={}){let{themes:i,languages:n,transformers:r,inlineStyles:s=false}=t,g=c(i);if(g.length>0){let h=await d(),a=g.filter(o=>!h.includes(o));if(a.length>0)throw new Error(`Unknown theme${a.length>1?"s":""}: ${a.join(", ")}. Available: ${h.join(", ")}.`)}return await highlightCodeBlocks(e,{...i?{themes:i}:{},...n?{languages:n}:{},...r?{transformers:r}:{},preStyles:s})}function f(e={}){let{themes:t,languages:i,transformers:n,inlineStyles:r=false}=e;return l({...t?{themes:t}:{},...i?{languages:i}:{},...n?{transformers:n}:{},preStyles:r})}export{d as availableThemes,f as default,y as defaultThemes,T as highlightTree};
+import e,{getHighlighter as t,highlightCodeBlocks as n}from"comark/plugins/highlight";import{bundledThemes as r}from"shiki";const i=e=>e?[e.light,e.dark].filter(e=>typeof e==`string`):[],a={light:`material-theme-lighter`,dark:`material-theme-palenight`};async function o(){let e=await t();return[.../* @__PURE__ */ new Set([...Object.keys(r),...e.getLoadedThemes?.()??[]])]}async function s(e,t={}){let{themes:r,languages:a,transformers:s,inlineStyles:c=!1}=t,l=i(r);if(l.length>0){let e=await o(),t=l.filter(t=>!e.includes(t));if(t.length>0)throw Error(`Unknown theme${t.length>1?`s`:``}: ${t.join(`, `)}. Available: ${e.join(`, `)}.`)}return await n(e,{...r?{themes:r}:{},...a?{languages:a}:{},...s?{transformers:s}:{},preStyles:c})}function c(t={}){let{themes:n,languages:r,transformers:i,inlineStyles:a=!1}=t;return e({...n?{themes:n}:{},...r?{languages:r}:{},...i?{transformers:i}:{},preStyles:a})}export{o as availableThemes,c as default,a as defaultThemes,s as highlightTree};

package/dist/plugins/sanitize.d.ts

@@ -0,0 +1,43 @@
+import * as comark from 'comark';
+import { ComarkNode } from 'comark';
+
+interface SanitizeOptions {
+    /** Tags removed with everything inside them, added to the default list. */
+    blockedTags?: string[];
+    /** Tags taken off the blocked list, e.g. `['iframe']` for embeds you trust or `['form', 'input', 'button']` for a form. */
+    allowedTags?: string[];
+    /**
+     * URL schemes allowed in links and sources. Relative URLs and `data:image/` image sources always pass.
+     * @default ['http', 'https', 'mailto', 'tel']
+     */
+    allowedProtocols?: string[];
+    /** Keeps every inline style. Off, a style keeps only colour and font declarations, which cannot move content or lay it over the page. @default false */
+    allowStyle?: boolean;
+    /** Components the `as` attribute may switch an element to; any other `as` is removed. @default [] */
+    allowedComponents?: string[];
+}
+/** Elements that run code, load another document, change how the page resolves URLs, or submit or capture input. */
+declare const defaultBlockedTags: string[];
+declare const defaultAllowedProtocols: string[];
+/** Whether a name would read Object.prototype from a plain object, `constructor` and `toString` among them. */
+declare function isPrototypeKey(name: string): boolean;
+/** Whether an attribute is safe to write: a plain name, not an event handler, not HTML, not a style unless allowed, not a URL outside `allowedProtocols`. A binding counts only when it is a literal. */
+declare function isSafeAttribute(tag: string, key: string, value: unknown, options?: SanitizeOptions): boolean;
+/** A copy of the tree with what would run script, submit a form, restyle the page or swap in another component removed; for a tree that did not come through the plugin. */
+declare function sanitizeTree<T extends {
+    nodes: ComarkNode[];
+}>(tree: T, options?: SanitizeOptions): T;
+/** The `sanitize` option every renderer takes, as options to pass on, or `false` when it is off. Unset means on. */
+declare function sanitizeOptions(setting: boolean | SanitizeOptions | undefined): SanitizeOptions | false;
+/** A component map whose lookups never reach Object.prototype, so a `::constructor` node renders as an element, not as `Object`. */
+/**
+ * Whether a component registered app-wide may render a markdown tag. `Prose*` components restyle the elements sanitizing
+ * already allowed, so they always may; any other one only when sanitizing is off or `allowedComponents` names it.
+ */
+declare function allowsGlobalComponent(setting: boolean | SanitizeOptions | undefined, name: string): boolean;
+declare function componentMap<T>(components: Record<string, T> | null | undefined): Record<string, T>;
+/** Removes blocked elements, event handler, HTML and style attributes, unlisted `as` targets and disallowed URL schemes. Use for untrusted markdown; add it last so it sees what other plugins add. */
+declare const _default: comark.ComarkPluginFactory<SanitizeOptions, {}, {}>;
+
+export { allowsGlobalComponent, componentMap, _default as default, defaultAllowedProtocols, defaultBlockedTags, isPrototypeKey, isSafeAttribute, sanitizeOptions, sanitizeTree };
+export type { SanitizeOptions };

package/dist/plugins/sanitize.js

@@ -0,0 +1 @@
+import{defineComarkPlugin as e}from"comark";const t=[`script`,`style`,`iframe`,`frame`,`frameset`,`object`,`embed`,`applet`,`portal`,`base`,`meta`,`link`,`animate`,`animatemotion`,`animatetransform`,`animatecolor`,`set`,`handler`,`listener`,`form`,`input`,`button`,`textarea`,`select`],n=[`http`,`https`,`mailto`,`tel`],r=/^[a-z_][a-z0-9_.:-]*$/i,i=/^[a-z][a-z0-9_.:-]*$/i,a=/* @__PURE__ */ new Set([`innerhtml`,`outerhtml`,`dangerouslysetinnerhtml`,`srcdoc`]),o=/* @__PURE__ */ new Set([`href`,`src`,`action`,`formaction`,`xlink:href`,`xlinkhref`,`poster`,`background`,`cite`,`data`,`ping`,`lowsrc`,`dynsrc`,`longdesc`,`to`,`url`]),s=/^(?:color|background-color|font-style|font-weight|text-align|text-decoration(?:-line|-color|-style)?|--shiki-[a-z0-9-]+)$/,c=/^[\w\s#%.,()+-]+$/,l=/* @__PURE__ */ new Set([`__proto__`,`constructor`,`prototype`]);function u(e){return Object.prototype.hasOwnProperty.call(Object.prototype,e)}function d(e){return/^on[a-z]+$/.test(e.toLowerCase())||/^on[^a-z]/.test(e)}function f(e){return Number.isInteger(e)&&e>0&&e<=1114111&&(e<55296||e>57343)?String.fromCodePoint(e):`�`}function p(e){return e.replace(/&#x([0-9a-f]+);?/gi,(e,t)=>f(Number.parseInt(t,16))).replace(/&#(\d+);?/g,(e,t)=>f(Number(t))).replace(/&colon;?/gi,`:`).replace(/&tab;?|&newline;?/gi,``).replace(/[\u0000- \u007f-\u009f]/g,``).toLowerCase()}function m(e,t,n,r){let i=p(e),a=/^([a-z][a-z0-9+.-]*):/.exec(i)?.[1];return!a||r.has(a)?!0:a===`data`&&t===`src`&&n===`img`&&i.startsWith(`data:image/`)}const h=e=>e.replace(/[-_]/g,``).toLowerCase();function g(e={}){let r=new Set((e.allowedTags??[]).map(e=>e.toLowerCase()));return{blocked:new Set([...t,...e.blockedTags??[]].map(e=>e.toLowerCase()).filter(e=>!r.has(e))),allowedProtocols:new Set((e.allowedProtocols??n).map(e=>e.toLowerCase().replace(/:$/,``))),allowStyle:e.allowStyle===!0,allowedComponents:new Set((e.allowedComponents??[]).map(h))}}const _=(e,t)=>s.test(e.toLowerCase())&&c.test(t)&&!/url\(|expression|image/i.test(t);function v(e){if(typeof e==`string`){let t=e.split(`;`).map(e=>/^([-a-z0-9]+)\s*:([\s\S]*)$/i.exec(e.trim())).filter(e=>e!==null&&_(e[1],e[2].trim())).map(([,e,t])=>`${e}:${t.trim()}`);return t.length?t.join(`;`):void 0}if(e&&typeof e==`object`&&!Array.isArray(e)){let t=Object.entries(e).filter(([e,t])=>(typeof t==`string`||typeof t==`number`)&&_(e.replace(/[A-Z]/g,e=>`-${e.toLowerCase()}`),String(t)));return t.length?Object.fromEntries(t):void 0}}const y=Symbol(`unknown`);function b(e,t){if(typeof e!=`string`)return e;try{return JSON.parse(e)}catch{}let[n,...r]=e.split(`.`);if(!t||n!==`frontmatter`&&n!==`meta`||r.some(e=>l.has(e)))return y;let i=t[n];for(let e of r){if(!i||typeof i!=`object`||!Object.hasOwn(i,e))return;i=i[e]}return i}function x(e,t){return typeof e==`string`&&!u(e)&&t.allowedComponents.has(h(e))}function S(e,t,n,i,s){let c=t.startsWith(`:`),u=c?t.slice(1):t,f=u.toLowerCase();if(!r.test(u)||d(u)||a.has(f))return;if(f===`style`&&!i.allowStyle){let e=v(c?b(n,s):n);return e===void 0?void 0:c?[t,JSON.stringify(e)]:[t,e]}if((!o.has(f)||f===`data`&&e!==`object`)&&f!==`as`)return c&&typeof n==`string`&&n.split(`.`).some(e=>l.has(e))?void 0:[t,n];let p=c?b(n,s):n;if(p!==y&&typeof p==`string`&&!(f===`as`?!x(p,i):!m(p,f,e,i.allowedProtocols)))return c?[t,JSON.stringify(p)]:[t,n]}function C(e,t,n,r={}){return t===`$`||S(e.toLowerCase(),t,n,g(r))!==void 0}function w(e){let t=`:disabled`in e?e[`:disabled`]===`true`||e[`:disabled`]===!0:e.disabled===``||e.disabled===!0||e.disabled===`disabled`||e.disabled===`true`;return e.type===`checkbox`&&!(`:type`in e)&&t}function T(e,t,n,r){let i={};for(let[a,o]of Object.entries(t)){let t=a===`$`?[a,o]:S(e,a,o,n,r);t&&(i[t[0]]=t[1])}return i}function E(e,t,n){if(!Array.isArray(e))return typeof e==`string`?e:void 0;let[r,a,...o]=e;if(r===null)return e;if(typeof r!=`string`||!i.test(r)||u(r))return;let s=r.toLowerCase(),c=a&&typeof a==`object`?a:{};if(t.blocked.has(s)&&!(s===`input`&&w(c)))return;let l=o.map(e=>E(e,t,n)).filter(e=>e!==void 0);return[r,T(s,c,t,n),...l]}function D(e,t={}){let n=g(t),r=e,i={frontmatter:r.frontmatter??r.data??{},meta:r.meta??{}};return{...e,nodes:(e.nodes??[]).map(e=>E(e,n,i)).filter(e=>e!==void 0)}}function O(e){return e===!1?!1:typeof e==`object`&&e?e:{}}function k(e,t){let n=O(e);return n===!1||/^prose[-_]?/i.test(t)?!0:!u(t)&&g(n).allowedComponents.has(h(t))}function A(e){let t=Object.create(null);for(let e of Object.getOwnPropertyNames(Object.prototype))t[e]=void 0;return Object.assign(t,e??{})}var j=e((e={})=>({name:`primeui:sanitize`,post(t){t.tree.nodes=D(t.tree,e).nodes}}));export{k as allowsGlobalComponent,A as componentMap,j as default,n as defaultAllowedProtocols,t as defaultBlockedTags,u as isPrototypeKey,C as isSafeAttribute,O as sanitizeOptions,D as sanitizeTree};

package/dist/plugins/toc.js

@@ -1 +1 @@
-export*from'comark/plugins/toc';export{default}from'comark/plugins/toc';
+import e from"comark/plugins/toc";export*from"comark/plugins/toc";export{e as default};

package/dist/preset.d.ts

@@ -1,12 +1,7 @@
 import { ComarkPlugin, ComarkParseFn } from 'comark';
+import { SanitizeOptions } from './plugins/sanitize.js';
 
-/**
- * Options handed to the parser underneath.
- *
- * Deliberately loose: the parsing backend accepts more than this preset models, and
- * naming its option type here would put its full schema — and its name — into a public
- * signature. Anything valid for the backend passes through.
- */
+/** Options passed through to the underlying parser, kept loose so the backend type stays private. */
 type ParserPassthrough = Record<string, unknown>;
 interface DocsParserOptions {
     /** Heading ids for anchors. @default true */
@@ -17,16 +12,15 @@ interface DocsParserOptions {
     alert?: boolean;
     /** {{ binding }} interpolation. @default true */
     binding?: boolean;
-    /** Extra plugins — e.g. a configured highlight plugin from ./plugins/highlight. */
+    /** Extra plugins, e.g. a configured highlight plugin from ./plugins/highlight. */
     plugins?: ComarkPlugin<any, any>[];
+    /** Strips script, event handlers, styles, form controls and unsafe URLs after every other plugin. Disable only for trusted markdown. @default true */
+    sanitize?: boolean | SanitizeOptions;
     /** Options forwarded to the underlying parser. Plugins are set by this preset. */
     parse?: ParserPassthrough;
 }
-/**
- * Docs-flavored parser preset: the plugin set every showcase/docs app needs,
- * assembled once. Syntax highlighting is intentionally NOT bundled — shiki is
- * heavy and optional; pass a configured highlight plugin via `plugins`.
- */
+/** Docs parser preset. Highlighting is not bundled; pass a configured highlight plugin via `plugins`. */
 declare function createDocsParser(options?: DocsParserOptions): ComarkParseFn<any, any>;
 
-export { type DocsParserOptions, type ParserPassthrough, createDocsParser };
+export { createDocsParser };
+export type { DocsParserOptions, ParserPassthrough };

package/dist/preset.js

@@ -1 +1 @@
-import {createParse}from'comark';import e from'comark/plugins/alert';import o from'comark/plugins/binding';import s from'comark/plugins/headings';import i from'comark/plugins/toc';function g(r={}){let a=[];return r.headings!==false&&a.push(s()),r.toc!==false&&a.push(i()),r.alert!==false&&a.push(e()),r.binding!==false&&a.push(o()),r.plugins&&a.push(...r.plugins),createParse({...r.parse,plugins:a})}export{g as createDocsParser};
+import e,{sanitizeOptions as t}from"./plugins/sanitize.js";import{createParse as n}from"comark";import r from"comark/plugins/alert";import i from"comark/plugins/binding";import a from"comark/plugins/headings";import o from"comark/plugins/toc";function s(s={}){let c=[];s.headings!==!1&&c.push(a()),s.toc!==!1&&c.push(o()),s.alert!==!1&&c.push(r()),s.binding!==!1&&c.push(i()),s.plugins&&c.push(...s.plugins);let l=t(s.sanitize);return l&&c.push(e(l)),n({...s.parse,plugins:c})}export{s as createDocsParser};

package/dist/prose.d.ts

@@ -1,4 +1,5 @@
 declare const PROSE_COMPONENTS: readonly ["ProseA", "ProseBlockquote", "ProseCode", "ProseEm", "ProseH1", "ProseH2", "ProseH3", "ProseH4", "ProseH5", "ProseH6", "ProseHr", "ProseImg", "ProseLi", "ProseOl", "ProseP", "ProsePre", "ProseStrong", "ProseTable", "ProseTbody", "ProseTd", "ProseTh", "ProseThead", "ProseTr", "ProseUl"];
 type ProseComponentName = (typeof PROSE_COMPONENTS)[number];
 
-export { PROSE_COMPONENTS, type ProseComponentName };
+export { PROSE_COMPONENTS };
+export type { ProseComponentName };

package/dist/prose.js

@@ -1 +1 @@
-var e=["ProseA","ProseBlockquote","ProseCode","ProseEm","ProseH1","ProseH2","ProseH3","ProseH4","ProseH5","ProseH6","ProseHr","ProseImg","ProseLi","ProseOl","ProseP","ProsePre","ProseStrong","ProseTable","ProseTbody","ProseTd","ProseTh","ProseThead","ProseTr","ProseUl"];export{e as PROSE_COMPONENTS};
+const e=[`ProseA`,`ProseBlockquote`,`ProseCode`,`ProseEm`,`ProseH1`,`ProseH2`,`ProseH3`,`ProseH4`,`ProseH5`,`ProseH6`,`ProseHr`,`ProseImg`,`ProseLi`,`ProseOl`,`ProseP`,`ProsePre`,`ProseStrong`,`ProseTable`,`ProseTbody`,`ProseTd`,`ProseTh`,`ProseThead`,`ProseTr`,`ProseUl`];export{e as PROSE_COMPONENTS};

package/dist/search.d.ts

@@ -13,18 +13,10 @@ interface SearchDocument {
     heading: string;
     text: string;
 }
-/**
- * Flattens parsed pages into heading-level search documents. The output is
- * plain JSON: ship it to the client for local search, hand it to Algolia, or
- * serve it to agents — same records everywhere.
- */
+/** Flattens parsed pages into heading-level search documents as plain JSON. */
 declare function buildSearchIndex(pages: SearchPage[]): SearchDocument[];
-/**
- * Dependency-free local search over an index: case-insensitive, every term
- * must match, heading/title hits outrank body hits. Good enough for docs-size
- * indexes; swap in Algolia or MiniSearch behind the same SearchDocument shape
- * when the corpus outgrows it.
- */
+/** Case-insensitive local search; every term must match, heading hits rank above body hits. */
 declare function searchDocuments(index: SearchDocument[], query: string, limit?: number): SearchDocument[];
 
-export { type SearchDocument, type SearchPage, buildSearchIndex, searchDocuments };
+export { buildSearchIndex, searchDocuments };
+export type { SearchDocument, SearchPage };

package/dist/search.js

@@ -1 +1 @@
-function g(e){return String(e?.frontmatter?.title??e?.meta?.title??"")}function u(e){return Array.isArray(e)}function d(e){return e[0]}function k(e){return e[1]??{}}function w(e){return e.slice(2)}function s(e){return typeof e=="string"?e:Array.isArray(e)&&typeof e[0]!="string"?e.map(o=>s(o)).join(""):u(e)?w(e).map(o=>s(o)).join(""):""}var x=new Set(["h1","h2","h3","h4","h5","h6"]);function l(e){let o=[],n={id:"",heading:"",depth:0,text:""};for(let t of e.nodes??[]){if(u(t)&&x.has(d(t))){(n.text.trim()||n.heading)&&o.push(n),n={id:String(k(t).id??""),heading:s(t),depth:Number(d(t).slice(1)),text:""};continue}if(u(t)&&d(t)==="pre")continue;let i=s(t).trim();i&&(n.text+=(n.text?" ":"")+i);}return (n.text.trim()||n.heading)&&o.push(n),o}function T(e){let o=[];for(let{route:n,tree:t}of e){let i=g(t);for(let r of l(t))o.push({url:r.id?`${n}#${r.id}`:n,route:n,page:i,heading:r.heading||i,text:r.text});}return o}function N(e,o,n=10){let t=o.toLowerCase().split(/\s+/).filter(Boolean);if(!t.length)return [];let i=[];for(let r of e){let c=(r.page+" "+r.heading).toLowerCase(),p=r.text.toLowerCase(),a=0;for(let f of t){let m=c.includes(f),h=p.includes(f);if(!m&&!h){a=0;break}a+=m?5:1;}a>0&&i.push({doc:r,score:a});}return i.sort((r,c)=>c.score-r.score).slice(0,n).map(r=>r.doc)}export{T as buildSearchIndex,N as searchDocuments};
+import{headingSections as e,titleFromTree as t}from"./tree.js";function n(n){let r=[];for(let{route:i,tree:a}of n){let n=t(a);for(let t of e(a))r.push({url:t.id?`${i}#${t.id}`:i,route:i,page:n,heading:t.heading||n,text:t.text})}return r}function r(e,t,n=10){let r=t.toLowerCase().split(/\s+/).filter(Boolean);if(!r.length)return[];let i=[];for(let t of e){let e=(t.page+` `+t.heading).toLowerCase(),n=t.text.toLowerCase(),a=0;for(let t of r){let r=e.includes(t),i=n.includes(t);if(!r&&!i){a=0;break}a+=r?5:1}a>0&&i.push({doc:t,score:a})}return i.sort((e,t)=>t.score-e.score).slice(0,n).map(e=>e.doc)}export{n as buildSearchIndex,r as searchDocuments};

package/dist/tree.d.ts

@@ -1,5 +1,4 @@
 import { ComarkElement, ComarkNode, ComarkTree } from 'comark';
-import 'comark/utils';
 
 interface TocItem {
     id: string;
@@ -17,12 +16,9 @@ declare function isElement(node: ComarkNode): node is ComarkElement;
 declare function tagOf(node: ComarkElement): string;
 declare function propsOf(node: ComarkElement): Record<string, unknown>;
 declare function childrenOf(node: ComarkElement): ComarkNode[];
-/**
- * Depth-first walk over every node in the tree. Return `false` from the
- * visitor to skip a node's children.
- */
+/** Depth-first walk; return `false` from the visitor to skip a node's children. */
 declare function walkTree(tree: ComarkTree, visit: (node: ComarkNode, parent: ComarkElement | null) => void | boolean): void;
-/** Plain-text content of a node (or node list) — markup and components stripped. */
+/** Plain-text content of a node or node list, markup stripped. */
 declare function textOf(node: ComarkNode | ComarkNode[]): string;
 interface HeadingSection {
     /** Heading id (anchor target); empty for content before the first heading. */
@@ -34,11 +30,8 @@ interface HeadingSection {
     /** Plain text of everything under this heading, code blocks excluded. */
     text: string;
 }
-/**
- * Splits a page into heading-anchored sections of plain text — the natural
- * unit for search indexing and llms excerpts. Code blocks are excluded so
- * indexes stay prose-focused.
- */
+/** Splits a page into heading-anchored plain-text sections, code blocks excluded. */
 declare function headingSections(tree: ComarkTree): HeadingSection[];
 
-export { type HeadingSection, type TocItem, childrenOf, descriptionFromTree, headingSections, isElement, propsOf, tagOf, textOf, titleFromTree, tocFromTree, walkTree };
+export { childrenOf, descriptionFromTree, headingSections, isElement, propsOf, tagOf, textOf, titleFromTree, tocFromTree, walkTree };
+export type { HeadingSection, TocItem };

package/dist/tree.js

@@ -1 +1 @@
-function l(e){return e?.meta?.toc?.links??[]}function k(e){return String(e?.frontmatter?.title??e?.meta?.title??"")}function m(e){return String(e?.frontmatter?.description??"")}function i(e){return Array.isArray(e)}function d(e){return e[0]}function u(e){return e[1]??{}}function s(e){return e.slice(2)}function w(e,r){let t=(n,o)=>{if(!(r(n,o)===false||!i(n)))for(let c of s(n))t(c,n);};for(let n of e.nodes??[])t(n,null);}function a(e){return typeof e=="string"?e:Array.isArray(e)&&typeof e[0]!="string"?e.map(r=>a(r)).join(""):i(e)?s(e).map(r=>a(r)).join(""):""}var f=new Set(["h1","h2","h3","h4","h5","h6"]);function p(e){let r=[],t={id:"",heading:"",depth:0,text:""};for(let n of e.nodes??[]){if(i(n)&&f.has(d(n))){(t.text.trim()||t.heading)&&r.push(t),t={id:String(u(n).id??""),heading:a(n),depth:Number(d(n).slice(1)),text:""};continue}if(i(n)&&d(n)==="pre")continue;let o=a(n).trim();o&&(t.text+=(t.text?" ":"")+o);}return (t.text.trim()||t.heading)&&r.push(t),r}export{s as childrenOf,m as descriptionFromTree,p as headingSections,i as isElement,u as propsOf,d as tagOf,a as textOf,k as titleFromTree,l as tocFromTree,w as walkTree};
+function e(e){return e?.meta?.toc?.links??[]}function t(e){return String(e?.frontmatter?.title??e?.meta?.title??``)}function n(e){return String(e?.frontmatter?.description??``)}function r(e){return Array.isArray(e)}function i(e){return e[0]}function a(e){return e[1]??{}}function o(e){return e.slice(2)}function s(e,t){let n=(e,i)=>{if(t(e,i)!==!1&&r(e))for(let t of o(e))n(t,e)};for(let t of e.nodes??[])n(t,null)}function c(e){return typeof e==`string`?e:Array.isArray(e)&&e[0]===null?``:Array.isArray(e)&&typeof e[0]!=`string`?e.map(e=>c(e)).join(``):r(e)?o(e).map(e=>c(e)).join(``):``}const l=/* @__PURE__ */ new Set([`h1`,`h2`,`h3`,`h4`,`h5`,`h6`]);function u(e){let t=[],n={id:``,heading:``,depth:0,text:``};for(let o of e.nodes??[]){if(r(o)&&l.has(i(o))){(n.text.trim()||n.heading)&&t.push(n),n={id:String(a(o).id??``),heading:c(o),depth:Number(i(o).slice(1)),text:``};continue}if(r(o)&&i(o)===`pre`)continue;let e=c(o).trim();e&&(n.text+=(n.text?` `:``)+e)}return(n.text.trim()||n.heading)&&t.push(n),t}export{o as childrenOf,n as descriptionFromTree,u as headingSections,r as isElement,a as propsOf,i as tagOf,c as textOf,t as titleFromTree,e as tocFromTree,s as walkTree};

package/package.json

@@ -1,57 +1,56 @@
 {
   "name": "@primeui-devkit/markdown-core",
-  "version": "0.1.0-rc.2",
-  "description": "Framework-agnostic markdown engine. Parses markdown with component directives into a serializable tree consumed by the framework renderers. The parsing backend is an internal implementation detail.",
+  "version": "0.1.0-rc.4",
   "author": "PrimeTek Informatics",
+  "description": "Framework-agnostic markdown engine. Parses markdown with component directives into a serializable tree consumed by the framework renderers. The parsing backend is an internal implementation detail.",
   "license": "SEE LICENSE IN LICENSE.md",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/primefaces/primeui-devkit.git",
+    "directory": "packages/markdown/markdown-core"
+  },
   "bugs": {
     "url": "https://support.primeui.dev"
   },
   "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     },
     "./preset": {
       "types": "./dist/preset.d.ts",
-      "import": "./dist/preset.js"
+      "import": "./dist/preset.js",
+      "default": "./dist/preset.js"
     },
     "./tree": {
       "types": "./dist/tree.d.ts",
-      "import": "./dist/tree.js"
+      "import": "./dist/tree.js",
+      "default": "./dist/tree.js"
     },
     "./search": {
       "types": "./dist/search.d.ts",
-      "import": "./dist/search.js"
+      "import": "./dist/search.js",
+      "default": "./dist/search.js"
     },
     "./llms": {
       "types": "./dist/llms.d.ts",
-      "import": "./dist/llms.js"
+      "import": "./dist/llms.js",
+      "default": "./dist/llms.js"
     },
     "./prose": {
       "types": "./dist/prose.d.ts",
-      "import": "./dist/prose.js"
-    },
-    "./plugins/headings": {
-      "types": "./dist/plugins/headings.d.ts",
-      "import": "./dist/plugins/headings.js"
+      "import": "./dist/prose.js",
+      "default": "./dist/prose.js"
     },
-    "./plugins/toc": {
-      "types": "./dist/plugins/toc.d.ts",
-      "import": "./dist/plugins/toc.js"
-    },
-    "./plugins/highlight": {
-      "types": "./dist/plugins/highlight.d.ts",
-      "import": "./dist/plugins/highlight.js"
-    },
-    "./plugins/alert": {
-      "types": "./dist/plugins/alert.d.ts",
-      "import": "./dist/plugins/alert.js"
-    },
-    "./plugins/binding": {
-      "types": "./dist/plugins/binding.d.ts",
-      "import": "./dist/plugins/binding.js"
+    "./plugins/*": {
+      "types": "./dist/plugins/*.d.ts",
+      "import": "./dist/plugins/*.js",
+      "default": "./dist/plugins/*.js"
     },
     "./package.json": "./package.json"
   },
@@ -72,32 +71,21 @@
       "prose": [
         "./dist/prose.d.ts"
       ],
-      "plugins/headings": [
-        "./dist/plugins/headings.d.ts"
-      ],
-      "plugins/toc": [
-        "./dist/plugins/toc.d.ts"
-      ],
-      "plugins/highlight": [
-        "./dist/plugins/highlight.d.ts"
-      ],
-      "plugins/alert": [
-        "./dist/plugins/alert.d.ts"
-      ],
-      "plugins/binding": [
-        "./dist/plugins/binding.d.ts"
+      "plugins/*": [
+        "./dist/plugins/*.d.ts"
       ]
     }
   },
-  "types": "./dist/index.d.ts",
-  "module": "./dist/index.js",
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
   "files": [
     "dist",
     "LICENSE.md",
     "THIRD-PARTY-NOTICES.txt",
     "README.md"
   ],
-  "sideEffects": false,
   "dependencies": {
     "comark": "^0.5.1"
   },
@@ -112,19 +100,19 @@
   "devDependencies": {
     "@shikijs/transformers": "^4.4.2",
     "cross-env": "^10.1.0",
-    "tsup": "^8.5.1",
     "typescript": "~6.0.0",
-    "vitest": "4.1.10",
-    "@primeui-devkit/test-config": "0.0.0",
-    "@primeui-devkit/ts-config": "0.0.0",
-    "@primeui-devkit/bundler": "0.0.0"
+    "vitest": "4.1.11",
+    "@primeui-devkit/bundle": "0.1.0-rc.2",
+    "@primeui-devkit/cli": "0.1.0-rc.2",
+    "@primeui-devkit/ts-config": "0.1.0-rc.2",
+    "@primeui-devkit/test-config": "0.1.0-rc.2"
   },
-  "publishConfig": {
-    "access": "public"
+  "engines": {
+    "node": ">=22.18.0"
   },
   "scripts": {
     "build": "pnpm run build:package",
-    "build:package": "pnpm run test && tsup",
+    "build:package": "pnpm run test && devkit bundle build",
     "type:check": "tsc --noEmit",
     "test": "cross-env NODE_ENV=test vitest run",
     "test:watch": "vitest --watch",