@readme/markdown 15.0.0 → 15.0.2

package/dist/main.js

@@ -14677,72 +14677,319 @@ function push(list, items) {
   return items
 }
 
+;// ./node_modules/micromark-util-subtokenize/lib/splice-buffer.js
+/**
+ * Some of the internal operations of micromark do lots of editing
+ * operations on very large arrays. This runs into problems with two
+ * properties of most circa-2020 JavaScript interpreters:
+ *
+ *  - Array-length modifications at the high end of an array (push/pop) are
+ *    expected to be common and are implemented in (amortized) time
+ *    proportional to the number of elements added or removed, whereas
+ *    other operations (shift/unshift and splice) are much less efficient.
+ *  - Function arguments are passed on the stack, so adding tens of thousands
+ *    of elements to an array with `arr.push(...newElements)` will frequently
+ *    cause stack overflows. (see <https://stackoverflow.com/questions/22123769/rangeerror-maximum-call-stack-size-exceeded-why>)
+ *
+ * SpliceBuffers are an implementation of gap buffers, which are a
+ * generalization of the "queue made of two stacks" idea. The splice buffer
+ * maintains a cursor, and moving the cursor has cost proportional to the
+ * distance the cursor moves, but inserting, deleting, or splicing in
+ * new information at the cursor is as efficient as the push/pop operation.
+ * This allows for an efficient sequence of splices (or pushes, pops, shifts,
+ * or unshifts) as long such edits happen at the same part of the array or
+ * generally sweep through the array from the beginning to the end.
+ *
+ * The interface for splice buffers also supports large numbers of inputs by
+ * passing a single array argument rather passing multiple arguments on the
+ * function call stack.
+ *
+ * @template T
+ *   Item type.
+ */
+class SpliceBuffer {
+  /**
+   * @param {ReadonlyArray<T> | null | undefined} [initial]
+   *   Initial items (optional).
+   * @returns
+   *   Splice buffer.
+   */
+  constructor(initial) {
+    /** @type {Array<T>} */
+    this.left = initial ? [...initial] : [];
+    /** @type {Array<T>} */
+    this.right = [];
+  }
+
+  /**
+   * Array access;
+   * does not move the cursor.
+   *
+   * @param {number} index
+   *   Index.
+   * @return {T}
+   *   Item.
+   */
+  get(index) {
+    if (index < 0 || index >= this.left.length + this.right.length) {
+      throw new RangeError('Cannot access index `' + index + '` in a splice buffer of size `' + (this.left.length + this.right.length) + '`');
+    }
+    if (index < this.left.length) return this.left[index];
+    return this.right[this.right.length - index + this.left.length - 1];
+  }
+
+  /**
+   * The length of the splice buffer, one greater than the largest index in the
+   * array.
+   */
+  get length() {
+    return this.left.length + this.right.length;
+  }
+
+  /**
+   * Remove and return `list[0]`;
+   * moves the cursor to `0`.
+   *
+   * @returns {T | undefined}
+   *   Item, optional.
+   */
+  shift() {
+    this.setCursor(0);
+    return this.right.pop();
+  }
+
+  /**
+   * Slice the buffer to get an array;
+   * does not move the cursor.
+   *
+   * @param {number} start
+   *   Start.
+   * @param {number | null | undefined} [end]
+   *   End (optional).
+   * @returns {Array<T>}
+   *   Array of items.
+   */
+  slice(start, end) {
+    /** @type {number} */
+    const stop = end === null || end === undefined ? Number.POSITIVE_INFINITY : end;
+    if (stop < this.left.length) {
+      return this.left.slice(start, stop);
+    }
+    if (start > this.left.length) {
+      return this.right.slice(this.right.length - stop + this.left.length, this.right.length - start + this.left.length).reverse();
+    }
+    return this.left.slice(start).concat(this.right.slice(this.right.length - stop + this.left.length).reverse());
+  }
+
+  /**
+   * Mimics the behavior of Array.prototype.splice() except for the change of
+   * interface necessary to avoid segfaults when patching in very large arrays.
+   *
+   * This operation moves cursor is moved to `start` and results in the cursor
+   * placed after any inserted items.
+   *
+   * @param {number} start
+   *   Start;
+   *   zero-based index at which to start changing the array;
+   *   negative numbers count backwards from the end of the array and values
+   *   that are out-of bounds are clamped to the appropriate end of the array.
+   * @param {number | null | undefined} [deleteCount=0]
+   *   Delete count (default: `0`);
+   *   maximum number of elements to delete, starting from start.
+   * @param {Array<T> | null | undefined} [items=[]]
+   *   Items to include in place of the deleted items (default: `[]`).
+   * @return {Array<T>}
+   *   Any removed items.
+   */
+  splice(start, deleteCount, items) {
+    /** @type {number} */
+    const count = deleteCount || 0;
+    this.setCursor(Math.trunc(start));
+    const removed = this.right.splice(this.right.length - count, Number.POSITIVE_INFINITY);
+    if (items) chunkedPush(this.left, items);
+    return removed.reverse();
+  }
+
+  /**
+   * Remove and return the highest-numbered item in the array, so
+   * `list[list.length - 1]`;
+   * Moves the cursor to `length`.
+   *
+   * @returns {T | undefined}
+   *   Item, optional.
+   */
+  pop() {
+    this.setCursor(Number.POSITIVE_INFINITY);
+    return this.left.pop();
+  }
+
+  /**
+   * Inserts a single item to the high-numbered side of the array;
+   * moves the cursor to `length`.
+   *
+   * @param {T} item
+   *   Item.
+   * @returns {undefined}
+   *   Nothing.
+   */
+  push(item) {
+    this.setCursor(Number.POSITIVE_INFINITY);
+    this.left.push(item);
+  }
+
+  /**
+   * Inserts many items to the high-numbered side of the array.
+   * Moves the cursor to `length`.
+   *
+   * @param {Array<T>} items
+   *   Items.
+   * @returns {undefined}
+   *   Nothing.
+   */
+  pushMany(items) {
+    this.setCursor(Number.POSITIVE_INFINITY);
+    chunkedPush(this.left, items);
+  }
+
+  /**
+   * Inserts a single item to the low-numbered side of the array;
+   * Moves the cursor to `0`.
+   *
+   * @param {T} item
+   *   Item.
+   * @returns {undefined}
+   *   Nothing.
+   */
+  unshift(item) {
+    this.setCursor(0);
+    this.right.push(item);
+  }
+
+  /**
+   * Inserts many items to the low-numbered side of the array;
+   * moves the cursor to `0`.
+   *
+   * @param {Array<T>} items
+   *   Items.
+   * @returns {undefined}
+   *   Nothing.
+   */
+  unshiftMany(items) {
+    this.setCursor(0);
+    chunkedPush(this.right, items.reverse());
+  }
+
+  /**
+   * Move the cursor to a specific position in the array. Requires
+   * time proportional to the distance moved.
+   *
+   * If `n < 0`, the cursor will end up at the beginning.
+   * If `n > length`, the cursor will end up at the end.
+   *
+   * @param {number} n
+   *   Position.
+   * @return {undefined}
+   *   Nothing.
+   */
+  setCursor(n) {
+    if (n === this.left.length || n > this.left.length && this.right.length === 0 || n < 0 && this.left.length === 0) return;
+    if (n < this.left.length) {
+      // Move cursor to the this.left
+      const removed = this.left.splice(n, Number.POSITIVE_INFINITY);
+      chunkedPush(this.right, removed.reverse());
+    } else {
+      // Move cursor to the this.right
+      const removed = this.right.splice(this.left.length + this.right.length - n, Number.POSITIVE_INFINITY);
+      chunkedPush(this.left, removed.reverse());
+    }
+  }
+}
+
+/**
+ * Avoid stack overflow by pushing items onto the stack in segments
+ *
+ * @template T
+ *   Item type.
+ * @param {Array<T>} list
+ *   List to inject into.
+ * @param {ReadonlyArray<T>} right
+ *   Items to inject.
+ * @return {undefined}
+ *   Nothing.
+ */
+function chunkedPush(list, right) {
+  /** @type {number} */
+  let chunkStart = 0;
+  if (right.length < 10000) {
+    list.push(...right);
+  } else {
+    while (chunkStart < right.length) {
+      list.push(...right.slice(chunkStart, chunkStart + 10000));
+      chunkStart += 10000;
+    }
+  }
+}
 ;// ./node_modules/micromark-util-subtokenize/index.js
 /**
- * @typedef {import('micromark-util-types').Chunk} Chunk
- * @typedef {import('micromark-util-types').Event} Event
- * @typedef {import('micromark-util-types').Token} Token
+ * @import {Chunk, Event, Token} from 'micromark-util-types'
  */
 
 
+
+
+// Hidden API exposed for testing.
+
+
 /**
  * Tokenize subcontent.
  *
- * @param {Array<Event>} events
+ * @param {Array<Event>} eventsArray
  *   List of events.
  * @returns {boolean}
  *   Whether subtokens were found.
- */ // eslint-disable-next-line complexity
-function subtokenize(events) {
+ */
+// eslint-disable-next-line complexity
+function subtokenize(eventsArray) {
   /** @type {Record<string, number>} */
-  const jumps = {}
-  let index = -1
+  const jumps = {};
+  let index = -1;
   /** @type {Event} */
-  let event
+  let event;
   /** @type {number | undefined} */
-  let lineIndex
+  let lineIndex;
   /** @type {number} */
-  let otherIndex
+  let otherIndex;
   /** @type {Event} */
-  let otherEvent
+  let otherEvent;
   /** @type {Array<Event>} */
-  let parameters
+  let parameters;
   /** @type {Array<Event>} */
-  let subevents
+  let subevents;
   /** @type {boolean | undefined} */
-  let more
+  let more;
+  const events = new SpliceBuffer(eventsArray);
   while (++index < events.length) {
     while (index in jumps) {
-      index = jumps[index]
+      index = jumps[index];
     }
-    event = events[index]
+    event = events.get(index);
 
     // Add a hook for the GFM tasklist extension, which needs to know if text
     // is in the first content of a list item.
-    if (
-      index &&
-      event[1].type === 'chunkFlow' &&
-      events[index - 1][1].type === 'listItemPrefix'
-    ) {
-      subevents = event[1]._tokenizer.events
-      otherIndex = 0
-      if (
-        otherIndex < subevents.length &&
-        subevents[otherIndex][1].type === 'lineEndingBlank'
-      ) {
-        otherIndex += 2
+    if (index && event[1].type === "chunkFlow" && events.get(index - 1)[1].type === "listItemPrefix") {
+      subevents = event[1]._tokenizer.events;
+      otherIndex = 0;
+      if (otherIndex < subevents.length && subevents[otherIndex][1].type === "lineEndingBlank") {
+        otherIndex += 2;
       }
-      if (
-        otherIndex < subevents.length &&
-        subevents[otherIndex][1].type === 'content'
-      ) {
+      if (otherIndex < subevents.length && subevents[otherIndex][1].type === "content") {
         while (++otherIndex < subevents.length) {
-          if (subevents[otherIndex][1].type === 'content') {
-            break
+          if (subevents[otherIndex][1].type === "content") {
+            break;
           }
-          if (subevents[otherIndex][1].type === 'chunkText') {
-            subevents[otherIndex][1]._isInFirstContentOfListItem = true
-            otherIndex++
+          if (subevents[otherIndex][1].type === "chunkText") {
+            subevents[otherIndex][1]._isInFirstContentOfListItem = true;
+            otherIndex++;
           }
         }
       }
@@ -14751,158 +14998,160 @@ function subtokenize(events) {
     // Enter.
     if (event[0] === 'enter') {
       if (event[1].contentType) {
-        Object.assign(jumps, subcontent(events, index))
-        index = jumps[index]
-        more = true
+        Object.assign(jumps, subcontent(events, index));
+        index = jumps[index];
+        more = true;
       }
     }
     // Exit.
     else if (event[1]._container) {
-      otherIndex = index
-      lineIndex = undefined
+      otherIndex = index;
+      lineIndex = undefined;
       while (otherIndex--) {
-        otherEvent = events[otherIndex]
-        if (
-          otherEvent[1].type === 'lineEnding' ||
-          otherEvent[1].type === 'lineEndingBlank'
-        ) {
+        otherEvent = events.get(otherIndex);
+        if (otherEvent[1].type === "lineEnding" || otherEvent[1].type === "lineEndingBlank") {
           if (otherEvent[0] === 'enter') {
             if (lineIndex) {
-              events[lineIndex][1].type = 'lineEndingBlank'
+              events.get(lineIndex)[1].type = "lineEndingBlank";
             }
-            otherEvent[1].type = 'lineEnding'
-            lineIndex = otherIndex
+            otherEvent[1].type = "lineEnding";
+            lineIndex = otherIndex;
           }
+        } else if (otherEvent[1].type === "linePrefix") {
+          // Move past.
         } else {
-          break
+          break;
         }
       }
       if (lineIndex) {
         // Fix position.
-        event[1].end = Object.assign({}, events[lineIndex][1].start)
+        event[1].end = {
+          ...events.get(lineIndex)[1].start
+        };
 
         // Switch container exit w/ line endings.
-        parameters = events.slice(lineIndex, index)
-        parameters.unshift(event)
-        splice(events, lineIndex, index - lineIndex + 1, parameters)
+        parameters = events.slice(lineIndex, index);
+        parameters.unshift(event);
+        events.splice(lineIndex, index - lineIndex + 1, parameters);
       }
     }
   }
-  return !more
+
+  // The changes to the `events` buffer must be copied back into the eventsArray
+  splice(eventsArray, 0, Number.POSITIVE_INFINITY, events.slice(0));
+  return !more;
 }
 
 /**
  * Tokenize embedded tokens.
  *
- * @param {Array<Event>} events
+ * @param {SpliceBuffer<Event>} events
+ *   Events.
  * @param {number} eventIndex
+ *   Index.
  * @returns {Record<string, number>}
+ *   Gaps.
  */
 function subcontent(events, eventIndex) {
-  const token = events[eventIndex][1]
-  const context = events[eventIndex][2]
-  let startPosition = eventIndex - 1
+  const token = events.get(eventIndex)[1];
+  const context = events.get(eventIndex)[2];
+  let startPosition = eventIndex - 1;
   /** @type {Array<number>} */
-  const startPositions = []
-  const tokenizer =
-    token._tokenizer || context.parser[token.contentType](token.start)
-  const childEvents = tokenizer.events
+  const startPositions = [];
+  const tokenizer = token._tokenizer || context.parser[token.contentType](token.start);
+  const childEvents = tokenizer.events;
   /** @type {Array<[number, number]>} */
-  const jumps = []
+  const jumps = [];
   /** @type {Record<string, number>} */
-  const gaps = {}
+  const gaps = {};
   /** @type {Array<Chunk>} */
-  let stream
+  let stream;
   /** @type {Token | undefined} */
-  let previous
-  let index = -1
+  let previous;
+  let index = -1;
   /** @type {Token | undefined} */
-  let current = token
-  let adjust = 0
-  let start = 0
-  const breaks = [start]
+  let current = token;
+  let adjust = 0;
+  let start = 0;
+  const breaks = [start];
 
   // Loop forward through the linked tokens to pass them in order to the
   // subtokenizer.
   while (current) {
     // Find the position of the event for this token.
-    while (events[++startPosition][1] !== current) {
+    while (events.get(++startPosition)[1] !== current) {
       // Empty.
     }
-    startPositions.push(startPosition)
+    startPositions.push(startPosition);
     if (!current._tokenizer) {
-      stream = context.sliceStream(current)
+      stream = context.sliceStream(current);
       if (!current.next) {
-        stream.push(null)
+        stream.push(null);
       }
       if (previous) {
-        tokenizer.defineSkip(current.start)
+        tokenizer.defineSkip(current.start);
       }
       if (current._isInFirstContentOfListItem) {
-        tokenizer._gfmTasklistFirstContentOfListItem = true
+        tokenizer._gfmTasklistFirstContentOfListItem = true;
       }
-      tokenizer.write(stream)
+      tokenizer.write(stream);
       if (current._isInFirstContentOfListItem) {
-        tokenizer._gfmTasklistFirstContentOfListItem = undefined
+        tokenizer._gfmTasklistFirstContentOfListItem = undefined;
       }
     }
 
     // Unravel the next token.
-    previous = current
-    current = current.next
+    previous = current;
+    current = current.next;
   }
 
   // Now, loop back through all events (and linked tokens), to figure out which
   // parts belong where.
-  current = token
+  current = token;
   while (++index < childEvents.length) {
     if (
-      // Find a void token that includes a break.
-      childEvents[index][0] === 'exit' &&
-      childEvents[index - 1][0] === 'enter' &&
-      childEvents[index][1].type === childEvents[index - 1][1].type &&
-      childEvents[index][1].start.line !== childEvents[index][1].end.line
-    ) {
-      start = index + 1
-      breaks.push(start)
+    // Find a void token that includes a break.
+    childEvents[index][0] === 'exit' && childEvents[index - 1][0] === 'enter' && childEvents[index][1].type === childEvents[index - 1][1].type && childEvents[index][1].start.line !== childEvents[index][1].end.line) {
+      start = index + 1;
+      breaks.push(start);
       // Help GC.
-      current._tokenizer = undefined
-      current.previous = undefined
-      current = current.next
+      current._tokenizer = undefined;
+      current.previous = undefined;
+      current = current.next;
     }
   }
 
   // Help GC.
-  tokenizer.events = []
+  tokenizer.events = [];
 
   // If there’s one more token (which is the cases for lines that end in an
   // EOF), that’s perfect: the last point we found starts it.
   // If there isn’t then make sure any remaining content is added to it.
   if (current) {
     // Help GC.
-    current._tokenizer = undefined
-    current.previous = undefined
+    current._tokenizer = undefined;
+    current.previous = undefined;
   } else {
-    breaks.pop()
+    breaks.pop();
   }
 
   // Now splice the events from the subtokenizer into the current events,
   // moving back to front so that splice indices aren’t affected.
-  index = breaks.length
+  index = breaks.length;
   while (index--) {
-    const slice = childEvents.slice(breaks[index], breaks[index + 1])
-    const start = startPositions.pop()
-    jumps.unshift([start, start + slice.length - 1])
-    splice(events, start, 2, slice)
+    const slice = childEvents.slice(breaks[index], breaks[index + 1]);
+    const start = startPositions.pop();
+    jumps.push([start, start + slice.length - 1]);
+    events.splice(start, 2, slice);
   }
-  index = -1
+  jumps.reverse();
+  index = -1;
   while (++index < jumps.length) {
-    gaps[adjust + jumps[index][0]] = adjust + jumps[index][1]
-    adjust += jumps[index][1] - jumps[index][0] - 1
+    gaps[adjust + jumps[index][0]] = adjust + jumps[index][1];
+    adjust += jumps[index][1] - jumps[index][0] - 1;
   }
-  return gaps
+  return gaps;
 }
-
 ;// ./node_modules/micromark/lib/postprocess.js
 /**
  * @typedef {import('micromark-util-types').Event} Event
@@ -54516,12 +54765,104 @@ const mdast = (text, opts = {}) => {
  */
 const jsxAcornParser = external_acorn_.Parser.extend(acorn_jsx_default()());
 
+;// ./lib/utils/literal-expression.ts
+
+const unsupported = (description) => new Error(`not a literal expression: ${description}`);
+/** Narrows a resolved value for arithmetic, so operands never coerce to `NaN` or `"[object Object]"`. */
+const asNumber = (value) => {
+    if (typeof value !== 'number')
+        throw unsupported('non-numeric operand');
+    return value;
+};
+const asOperand = (value) => {
+    if (typeof value !== 'number' && typeof value !== 'string')
+        throw unsupported('non-primitive operand');
+    return value;
+};
+const ARITHMETIC_OPERATORS = {
+    // `+` doubles as string concatenation, so it accepts a string on either side.
+    '+': (left, right) => (typeof left === 'number' && typeof right === 'number' ? left + right : `${left}${right}`),
+    '-': (left, right) => asNumber(left) - asNumber(right),
+    '*': (left, right) => asNumber(left) * asNumber(right),
+    '/': (left, right) => asNumber(left) / asNumber(right),
+};
+/** Resolve one estree node, recursing into arrays and objects. Throws for anything not on the allowlist. */
+const resolveNode = (node) => {
+    switch (node.type) {
+        case 'Literal':
+            // Regex and bigint `Literal`s hold values a tree consumer can't serialise;
+            // a BigInt throws outright in `JSON.stringify`.
+            if ('regex' in node || 'bigint' in node)
+                throw unsupported('regex or bigint literal');
+            return node.value;
+        case 'Identifier':
+            if (node.name !== 'undefined')
+                throw unsupported(`identifier \`${node.name}\``);
+            return undefined;
+        case 'TemplateLiteral':
+            if (node.expressions.length)
+                throw unsupported('template substitution');
+            return node.quasis.map(quasi => quasi.value.cooked).join('');
+        case 'UnaryExpression':
+            if (node.operator !== '-')
+                throw unsupported(`operator \`${node.operator}\``);
+            return -asNumber(resolveNode(node.argument));
+        case 'BinaryExpression': {
+            const applyOperator = ARITHMETIC_OPERATORS[node.operator];
+            if (!applyOperator)
+                throw unsupported(`operator \`${node.operator}\``);
+            return applyOperator(asOperand(resolveNode(node.left)), asOperand(resolveNode(node.right)));
+        }
+        case 'ArrayExpression':
+            return node.elements.map(element => (element === null ? null : resolveNode(element)));
+        case 'ObjectExpression':
+            return node.properties.reduce((memo, property) => {
+                if (property.type !== 'Property' || property.computed)
+                    throw unsupported('computed or spread property');
+                const { key } = property;
+                if (key.type !== 'Identifier' && key.type !== 'Literal')
+                    throw unsupported('property key');
+                const name = key.type === 'Identifier' ? key.name : String(key.value);
+                // `__proto__` would replace the object's prototype rather than add a property.
+                if (name === '__proto__')
+                    throw unsupported('`__proto__` key');
+                memo[name] = resolveNode(property.value);
+                return memo;
+            }, {});
+        default:
+            throw unsupported(node.type);
+    }
+};
+/**
+ * Resolve a JSX attribute expression's source to its value without executing it.
+ *
+ * Supports the literal syntax attributes actually use — `true`, `"a"`, `` `a` ``,
+ * `undefined`, `{ textAlign: "left" }`, `["left"]`, `1 + 1`, `'https://' + 'x.com'` —
+ * and refuses everything else, so no identifier, member access, call, assignment or
+ * function body can ever run. The trade-off is that expressions needing a scope or a
+ * method call (`{item.url}`, `{"a".toUpperCase()}`) throw, and callers keep the raw
+ * source instead — the same fallback they already used for an expression that threw.
+ * mdxish rendering is unaffected, since it resolves those later with its scoped
+ * evaluator; only consumers reading attributes straight off the tree see the source.
+ *
+ * @param source expression body, without the surrounding braces
+ * @throws if `source` is unparseable or isn't a supported literal expression
+ */
+const evaluateLiteralExpression = (source) => {
+    const expression = jsxAcornParser.parseExpressionAt(source, 0, { ecmaVersion: 'latest' });
+    // acorn stops at the first complete expression, so anything trailing means this isn't one.
+    if (expression.end !== source.trimEnd().length)
+        throw unsupported('trailing content');
+    return resolveNode(expression);
+};
+
 ;// ./processor/utils.ts
 
 
 
 
 
+
 /**
  * Evaluate a JavaScript expression source and return its value.
  *
@@ -54619,8 +54960,10 @@ const getAttrs = (jsx) => jsx.attributes.reduce((memo, attr) => {
             memo[attr.name] = decode_decodeHTMLStrict(attr.value);
         }
         else if (attr.value?.value !== undefined) {
+            // Expression values only survive to here when safeMode is off; `flattenAttributeExpressions`
+            // rewrites them to plain strings at the head of the pipeline otherwise.
             try {
-                memo[attr.name] = evaluate(attr.value.value);
+                memo[attr.name] = evaluateLiteralExpression(attr.value.value);
             }
             catch {
                 memo[attr.name] = attr.value.value;
@@ -55401,6 +55744,31 @@ const embedTransformer = () => {
 };
 /* harmony default export */ const transform_embeds = (embedTransformer);
 
+;// ./processor/transform/flatten-attribute-expressions.ts
+
+
+/**
+ * Rewrites JSX attribute expressions (`icon={String(1 + 3)}`) into plain string attributes
+ * holding their literal source, so nothing downstream can evaluate them.
+ *
+ * This is the RMDX counterpart to mdxish's `preserveExpressionsAsText` parse option: safeMode's
+ * contract is enforced once, at the head of the pipeline, rather than at every `getAttrs()` call
+ * site. Only registered when safeMode is on.
+ */
+const flattenAttributeExpressions = () => tree => {
+    visit(tree, isMDXElement, (node) => {
+        node.attributes.forEach(attr => {
+            if (!('name' in attr))
+                return;
+            if (attr.value === null || typeof attr.value === 'string')
+                return;
+            attr.value = attr.value.value;
+        });
+    });
+    return tree;
+};
+/* harmony default export */ const flatten_attribute_expressions = (flattenAttributeExpressions);
+
 ;// ./node_modules/gemoji/index.js
 /**
  * @typedef Gemoji
@@ -81170,6 +81538,7 @@ const variables = ({ asMdx } = { asMdx: true }) => tree => {
 
 
 
+
 const defaultTransforms = {
     calloutTransformer: callouts,
     codeTabsTransformer: code_tabs,
@@ -81197,6 +81566,9 @@ const astProcessor = (opts = {}) => {
     const components = opts.components || {};
     let processor = remark()
         .use(remarkMdx)
+        // Must precede every other transformer: it strips evaluable attribute expressions so no
+        // downstream `getAttrs()` call can reach `evaluate()`.
+        .use(opts.safeMode ? flatten_attribute_expressions : undefined)
         .use(remarkPlugins)
         .use(opts.remarkPlugins)
         .use(transform_variables, { asMdx: false })
@@ -93267,7 +93639,9 @@ class MdxSyntaxError extends SyntaxError {
  * as `\r<br>`. Treating both characters as hard breaks doubles the spacing.
  */
 const hardBreaks = () => tree => {
-    findAndReplace(tree, [/\r?\n/g, () => ({ type: 'break' })]);
+    // Skip `html-block`: its opaque payload is rendered verbatim, so turning its newlines
+    // into `break` nodes is unnecessary and costly on large blocks.
+    findAndReplace(tree, [/\r?\n/g, () => ({ type: 'break' })], { ignore: ['html-block'] });
 };
 /* harmony default export */ const hard_breaks = (hardBreaks);
 
@@ -95774,12 +96148,59 @@ const hastscript_lib_h = create_h_createH(node_modules_property_information_html
 /** @type {ReturnType<createH>} */
 const lib_s = create_h_createH(node_modules_property_information_svg, 'g', svg_case_sensitive_tag_names_svgCaseSensitiveTagNames)
 
+;// ./utils/user.ts
+/**
+ * Coerce a user variable value to a string for substitution into markdown text.
+ * Non-string values (arrays, objects, numbers) are stringified via JSON or `String()`
+ * so that `<<var>>` syntax doesn't produce `[object Object]` for structured data like
+ * JWT `keys`.
+ */
+const stringifyVariableValue = (value) => {
+    if (typeof value === 'string')
+        return value;
+    if (value == null)
+        return '';
+    if (typeof value === 'object') {
+        try {
+            return JSON.stringify(value) ?? '';
+        }
+        catch {
+            console.warn('[WARNING] Could not stringify a structured user variable.');
+            return '';
+        }
+    }
+    return String(value);
+};
+/**
+ * Flatten `variables.user` into a string-keyed string-valued record by coercing
+ * each value. Used by markdown substitution paths that need a plain
+ * `Record<string, string>` lookup.
+ */
+const flattenUserVariables = (user) => Object.fromEntries(Object.entries(user).map(([name, value]) => [name, stringifyVariableValue(value)]));
+const User = (variables) => {
+    const { user = {}, defaults = [] } = variables || {};
+    return new Proxy(user, {
+        get(target, attribute) {
+            if (typeof attribute === 'symbol') {
+                return '';
+            }
+            if (attribute in target) {
+                return target[attribute];
+            }
+            const def = defaults.find((d) => d.name === attribute);
+            return def ? def.default : attribute.toUpperCase();
+        },
+    });
+};
+/* harmony default export */ const user = (User);
+
 ;// ./processor/plugin/toc.ts
 
 
 
 
 
+
 const HEADING_TAGS = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6'];
 const isHeadingTag = (tag) => (tag ? HEADING_TAGS.includes(tag) : false);
 const isStandardHtmlElement = (node) => STANDARD_HTML_TAGS.has(node.tagName.toLowerCase());
@@ -95891,7 +96312,7 @@ const flattenVariables = (variables) => {
     if (!variables)
         return {};
     return {
-        ...variables.user,
+        ...flattenUserVariables(variables.user),
         ...Object.fromEntries((variables.defaults || []).filter(d => !(d.name in variables.user)).map(d => [d.name, d.default])),
     };
 };
@@ -96039,7 +96460,7 @@ const exports_exports = (doc) => {
 
 const hast = (text, opts = {}) => {
     const components = Object.entries(opts.components || {}).reduce((memo, [name, doc]) => {
-        memo[name] = lib_mdast(doc);
+        memo[name] = lib_mdast(doc, { safeMode: opts.safeMode });
         return memo;
     }, {});
     const processor = ast_processor(opts)
@@ -103736,6 +104157,10 @@ const NESTED_ATTR_EXPRESSION_RE = /[\w-]+\s*=\s*\{/;
 // Name shape mirrors `componentTagPattern`; the lookbehind skips the inner tag
 // of a legacy `<<VARIABLE>>`.
 const NESTED_COMPONENT_TAG_RE = /(?<!<)<([A-Z][A-Za-z0-9_]*)[\s/>]/g;
+// Whole blank lines at a component body's edges. `\n` sits inside each group so a
+// match can only ever span complete lines, never part of a content line.
+const LEADING_BLANK_LINES_RE = /^(?:[ \t]*\n)+/;
+const TRAILING_BLANK_LINES_RE = /(?:\n[ \t]*)+$/;
 // Excludes tags with dedicated transformers (`Table`, `HTMLBlock`, inline
 // components), which expect their wrapper to stay raw.
 const hasNestedGenericComponentTag = (content) => [...content.matchAll(NESTED_COMPONENT_TAG_RE)].some(match => !GENERIC_MDX_COMPONENT_EXCLUDED_TAGS.has(match[1]));
@@ -103769,13 +104194,21 @@ function safeDeindent(text) {
     })
         .join('\n');
 }
+/**
+ * Drop the blank lines at a component body's edges, keeping the first content line's
+ * indent: `.trim()` stripped that line alone, so a uniformly indented body reparsed
+ * lopsided and every list item after the first nested. The trailing pattern
+ * takes the last content line's newline but leaves its spaces, which are code content
+ * when a fence runs into the end tag.
+ */
+const trimBlankEdges = (text) => text.replace(LEADING_BLANK_LINES_RE, '').replace(TRAILING_BLANK_LINES_RE, '');
 /**
  * Parse component-body markdown into mdast children. Dedenting shifts columns and
  * stales the top-level `terminateHtmlFlowBlocks` decisions, so that one preprocessor
  * re-runs here; other column-anchored fixups (compact headings, tables) do not.
  */
 const parseMdChildren = (value, safeMode) => {
-    const reparseSource = terminateHtmlFlowBlocks(safeDeindent(value).trim());
+    const reparseSource = terminateHtmlFlowBlocks(trimBlankEdges(safeDeindent(value)));
     const parsed = getInlineMdProcessor({ safeMode }).parse(reparseSource);
     // Promote nested wrappers bottom-up so an outer wrapper sees markdown buried in a
     // child claimed whole (e.g. `<li>` in `<ol>`) before its containsMarkdownConstruct check (RM-17560).
@@ -103940,7 +104373,8 @@ function promoteComponentBlocks(tree, safeMode, source) {
         // Case 2: Self-contained block (closing tag in content)
         const closingTagIndex = isPlainLowercaseHtml ? plainClosingTagIndex : contentAfterTag.lastIndexOf(closingTagStr);
         if (closingTagIndex >= 0) {
-            // Untrimmed so parseMdChildren can dedent before trimming.
+            // Left as authored: parseMdChildren needs the original columns to dedent by, and
+            // it clears the blank edges itself.
             const componentInnerContent = contentAfterTag.substring(0, closingTagIndex);
             const contentAfterClose = contentAfterTag.substring(closingTagIndex + closingTagStr.length).trim();
             let parsedChildren = [];
@@ -106662,6 +107096,7 @@ function normalizeTableSeparator(content) {
 ;// ./processor/transform/mdxish/variables-code.ts
 
 
+
 // Single combined regex so that resolved values from one pattern are never re-scanned by the other.
 const COMBINED_VARIABLE_REGEX = new RegExp(`${variable_.VARIABLE_REGEXP}|${variable_.MDX_VARIABLE_REGEXP}`, 'giu');
 // Flatten variables into a single object for easy lookup
@@ -106670,7 +107105,7 @@ function variables_code_flattenVariables(variables) {
         return {};
     return {
         ...Object.fromEntries((variables.defaults || []).map(d => [d.name, d.default])),
-        ...variables.user,
+        ...flattenUserVariables(variables.user),
     };
 }
 function resolveCodeVariables(value, resolvedVariables) {
@@ -107214,24 +107649,6 @@ const Contexts = ({ children, terms = [], variables = { user: {}, defaults: [] }
 };
 /* harmony default export */ const contexts = (Contexts);
 
-;// ./utils/user.ts
-const User = (variables) => {
-    const { user = {}, defaults = [] } = variables || {};
-    return new Proxy(user, {
-        get(target, attribute) {
-            if (typeof attribute === 'symbol') {
-                return '';
-            }
-            if (attribute in target) {
-                return target[attribute];
-            }
-            const def = defaults.find((d) => d.name === attribute);
-            return def ? def.default : attribute.toUpperCase();
-        },
-    });
-};
-/* harmony default export */ const user = (User);
-
 ;// ./lib/utils/makeUseMdxComponents.ts
 
 
@@ -107264,6 +107681,7 @@ const makeUseMDXComponents = (more = {}) => {
 
 ;// ./lib/utils/mdxish/mdxish-variables.ts
 
+
 // The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
 // substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
 // which either evaluated already or is meant to stay literal.
@@ -107287,7 +107705,7 @@ function resolveAttributeVariables(value, user) {
         .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
         if (escapePrefix || escapeSuffix)
             return source;
-        return user[name];
+        return stringifyVariableValue(user[name]);
     });
 }
 
@@ -107563,7 +107981,8 @@ const run_run = (string, _opts = {}) => {
 
 const tags = (doc) => {
     const set = new Set();
-    visit(lib_mdast(doc), isMDXElement, (node) => {
+    // Tag names never depend on evaluated attribute values, so always parse in safeMode.
+    visit(lib_mdast(doc, { safeMode: true }), isMDXElement, (node) => {
         if (node.name?.match(/^[A-Z]/)) {
             set.add(node.name);
         }
@@ -107579,13 +107998,14 @@ const tags = (doc) => {
 
 
 
-const { micromarkExtensions, fromMarkdownExtensions } = mdxishExtensions(FEATURES.tags);
+const { micromarkExtensions, fromMarkdownExtensions } = mdxishExtensions(FEATURES.tags, { safeMode: true });
 const mdxishTags_tags = (doc) => {
     const set = new Set();
     const processor = remark()
         .data('micromarkExtensions', micromarkExtensions)
         .data('fromMarkdownExtensions', fromMarkdownExtensions)
-        .use(mdx_blocks)
+        // Tag names never depend on evaluated attribute values, so always parse in safeMode.
+        .use(mdx_blocks, { safeMode: true })
         .use(mdxish_tables);
     const tree = processor.parse(doc);
     visit(processor.runSync(tree), isMDXElement, (node) => {