@readme/markdown 15.0.1 → 15.0.2

package/dist/main.js

@@ -54765,12 +54765,104 @@ const mdast = (text, opts = {}) => {
  */
 const jsxAcornParser = external_acorn_.Parser.extend(acorn_jsx_default()());
 
+;// ./lib/utils/literal-expression.ts
+
+const unsupported = (description) => new Error(`not a literal expression: ${description}`);
+/** Narrows a resolved value for arithmetic, so operands never coerce to `NaN` or `"[object Object]"`. */
+const asNumber = (value) => {
+    if (typeof value !== 'number')
+        throw unsupported('non-numeric operand');
+    return value;
+};
+const asOperand = (value) => {
+    if (typeof value !== 'number' && typeof value !== 'string')
+        throw unsupported('non-primitive operand');
+    return value;
+};
+const ARITHMETIC_OPERATORS = {
+    // `+` doubles as string concatenation, so it accepts a string on either side.
+    '+': (left, right) => (typeof left === 'number' && typeof right === 'number' ? left + right : `${left}${right}`),
+    '-': (left, right) => asNumber(left) - asNumber(right),
+    '*': (left, right) => asNumber(left) * asNumber(right),
+    '/': (left, right) => asNumber(left) / asNumber(right),
+};
+/** Resolve one estree node, recursing into arrays and objects. Throws for anything not on the allowlist. */
+const resolveNode = (node) => {
+    switch (node.type) {
+        case 'Literal':
+            // Regex and bigint `Literal`s hold values a tree consumer can't serialise;
+            // a BigInt throws outright in `JSON.stringify`.
+            if ('regex' in node || 'bigint' in node)
+                throw unsupported('regex or bigint literal');
+            return node.value;
+        case 'Identifier':
+            if (node.name !== 'undefined')
+                throw unsupported(`identifier \`${node.name}\``);
+            return undefined;
+        case 'TemplateLiteral':
+            if (node.expressions.length)
+                throw unsupported('template substitution');
+            return node.quasis.map(quasi => quasi.value.cooked).join('');
+        case 'UnaryExpression':
+            if (node.operator !== '-')
+                throw unsupported(`operator \`${node.operator}\``);
+            return -asNumber(resolveNode(node.argument));
+        case 'BinaryExpression': {
+            const applyOperator = ARITHMETIC_OPERATORS[node.operator];
+            if (!applyOperator)
+                throw unsupported(`operator \`${node.operator}\``);
+            return applyOperator(asOperand(resolveNode(node.left)), asOperand(resolveNode(node.right)));
+        }
+        case 'ArrayExpression':
+            return node.elements.map(element => (element === null ? null : resolveNode(element)));
+        case 'ObjectExpression':
+            return node.properties.reduce((memo, property) => {
+                if (property.type !== 'Property' || property.computed)
+                    throw unsupported('computed or spread property');
+                const { key } = property;
+                if (key.type !== 'Identifier' && key.type !== 'Literal')
+                    throw unsupported('property key');
+                const name = key.type === 'Identifier' ? key.name : String(key.value);
+                // `__proto__` would replace the object's prototype rather than add a property.
+                if (name === '__proto__')
+                    throw unsupported('`__proto__` key');
+                memo[name] = resolveNode(property.value);
+                return memo;
+            }, {});
+        default:
+            throw unsupported(node.type);
+    }
+};
+/**
+ * Resolve a JSX attribute expression's source to its value without executing it.
+ *
+ * Supports the literal syntax attributes actually use — `true`, `"a"`, `` `a` ``,
+ * `undefined`, `{ textAlign: "left" }`, `["left"]`, `1 + 1`, `'https://' + 'x.com'` —
+ * and refuses everything else, so no identifier, member access, call, assignment or
+ * function body can ever run. The trade-off is that expressions needing a scope or a
+ * method call (`{item.url}`, `{"a".toUpperCase()}`) throw, and callers keep the raw
+ * source instead — the same fallback they already used for an expression that threw.
+ * mdxish rendering is unaffected, since it resolves those later with its scoped
+ * evaluator; only consumers reading attributes straight off the tree see the source.
+ *
+ * @param source expression body, without the surrounding braces
+ * @throws if `source` is unparseable or isn't a supported literal expression
+ */
+const evaluateLiteralExpression = (source) => {
+    const expression = jsxAcornParser.parseExpressionAt(source, 0, { ecmaVersion: 'latest' });
+    // acorn stops at the first complete expression, so anything trailing means this isn't one.
+    if (expression.end !== source.trimEnd().length)
+        throw unsupported('trailing content');
+    return resolveNode(expression);
+};
+
 ;// ./processor/utils.ts
 
 
 
 
 
+
 /**
  * Evaluate a JavaScript expression source and return its value.
  *
@@ -54868,8 +54960,10 @@ const getAttrs = (jsx) => jsx.attributes.reduce((memo, attr) => {
             memo[attr.name] = decode_decodeHTMLStrict(attr.value);
         }
         else if (attr.value?.value !== undefined) {
+            // Expression values only survive to here when safeMode is off; `flattenAttributeExpressions`
+            // rewrites them to plain strings at the head of the pipeline otherwise.
             try {
-                memo[attr.name] = evaluate(attr.value.value);
+                memo[attr.name] = evaluateLiteralExpression(attr.value.value);
             }
             catch {
                 memo[attr.name] = attr.value.value;
@@ -55650,6 +55744,31 @@ const embedTransformer = () => {
 };
 /* harmony default export */ const transform_embeds = (embedTransformer);
 
+;// ./processor/transform/flatten-attribute-expressions.ts
+
+
+/**
+ * Rewrites JSX attribute expressions (`icon={String(1 + 3)}`) into plain string attributes
+ * holding their literal source, so nothing downstream can evaluate them.
+ *
+ * This is the RMDX counterpart to mdxish's `preserveExpressionsAsText` parse option: safeMode's
+ * contract is enforced once, at the head of the pipeline, rather than at every `getAttrs()` call
+ * site. Only registered when safeMode is on.
+ */
+const flattenAttributeExpressions = () => tree => {
+    visit(tree, isMDXElement, (node) => {
+        node.attributes.forEach(attr => {
+            if (!('name' in attr))
+                return;
+            if (attr.value === null || typeof attr.value === 'string')
+                return;
+            attr.value = attr.value.value;
+        });
+    });
+    return tree;
+};
+/* harmony default export */ const flatten_attribute_expressions = (flattenAttributeExpressions);
+
 ;// ./node_modules/gemoji/index.js
 /**
  * @typedef Gemoji
@@ -81419,6 +81538,7 @@ const variables = ({ asMdx } = { asMdx: true }) => tree => {
 
 
 
+
 const defaultTransforms = {
     calloutTransformer: callouts,
     codeTabsTransformer: code_tabs,
@@ -81446,6 +81566,9 @@ const astProcessor = (opts = {}) => {
     const components = opts.components || {};
     let processor = remark()
         .use(remarkMdx)
+        // Must precede every other transformer: it strips evaluable attribute expressions so no
+        // downstream `getAttrs()` call can reach `evaluate()`.
+        .use(opts.safeMode ? flatten_attribute_expressions : undefined)
         .use(remarkPlugins)
         .use(opts.remarkPlugins)
         .use(transform_variables, { asMdx: false })
@@ -96025,12 +96148,59 @@ const hastscript_lib_h = create_h_createH(node_modules_property_information_html
 /** @type {ReturnType<createH>} */
 const lib_s = create_h_createH(node_modules_property_information_svg, 'g', svg_case_sensitive_tag_names_svgCaseSensitiveTagNames)
 
+;// ./utils/user.ts
+/**
+ * Coerce a user variable value to a string for substitution into markdown text.
+ * Non-string values (arrays, objects, numbers) are stringified via JSON or `String()`
+ * so that `<<var>>` syntax doesn't produce `[object Object]` for structured data like
+ * JWT `keys`.
+ */
+const stringifyVariableValue = (value) => {
+    if (typeof value === 'string')
+        return value;
+    if (value == null)
+        return '';
+    if (typeof value === 'object') {
+        try {
+            return JSON.stringify(value) ?? '';
+        }
+        catch {
+            console.warn('[WARNING] Could not stringify a structured user variable.');
+            return '';
+        }
+    }
+    return String(value);
+};
+/**
+ * Flatten `variables.user` into a string-keyed string-valued record by coercing
+ * each value. Used by markdown substitution paths that need a plain
+ * `Record<string, string>` lookup.
+ */
+const flattenUserVariables = (user) => Object.fromEntries(Object.entries(user).map(([name, value]) => [name, stringifyVariableValue(value)]));
+const User = (variables) => {
+    const { user = {}, defaults = [] } = variables || {};
+    return new Proxy(user, {
+        get(target, attribute) {
+            if (typeof attribute === 'symbol') {
+                return '';
+            }
+            if (attribute in target) {
+                return target[attribute];
+            }
+            const def = defaults.find((d) => d.name === attribute);
+            return def ? def.default : attribute.toUpperCase();
+        },
+    });
+};
+/* harmony default export */ const user = (User);
+
 ;// ./processor/plugin/toc.ts
 
 
 
 
 
+
 const HEADING_TAGS = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6'];
 const isHeadingTag = (tag) => (tag ? HEADING_TAGS.includes(tag) : false);
 const isStandardHtmlElement = (node) => STANDARD_HTML_TAGS.has(node.tagName.toLowerCase());
@@ -96142,7 +96312,7 @@ const flattenVariables = (variables) => {
     if (!variables)
         return {};
     return {
-        ...variables.user,
+        ...flattenUserVariables(variables.user),
         ...Object.fromEntries((variables.defaults || []).filter(d => !(d.name in variables.user)).map(d => [d.name, d.default])),
     };
 };
@@ -96290,7 +96460,7 @@ const exports_exports = (doc) => {
 
 const hast = (text, opts = {}) => {
     const components = Object.entries(opts.components || {}).reduce((memo, [name, doc]) => {
-        memo[name] = lib_mdast(doc);
+        memo[name] = lib_mdast(doc, { safeMode: opts.safeMode });
         return memo;
     }, {});
     const processor = ast_processor(opts)
@@ -106926,6 +107096,7 @@ function normalizeTableSeparator(content) {
 ;// ./processor/transform/mdxish/variables-code.ts
 
 
+
 // Single combined regex so that resolved values from one pattern are never re-scanned by the other.
 const COMBINED_VARIABLE_REGEX = new RegExp(`${variable_.VARIABLE_REGEXP}|${variable_.MDX_VARIABLE_REGEXP}`, 'giu');
 // Flatten variables into a single object for easy lookup
@@ -106934,7 +107105,7 @@ function variables_code_flattenVariables(variables) {
         return {};
     return {
         ...Object.fromEntries((variables.defaults || []).map(d => [d.name, d.default])),
-        ...variables.user,
+        ...flattenUserVariables(variables.user),
     };
 }
 function resolveCodeVariables(value, resolvedVariables) {
@@ -107478,24 +107649,6 @@ const Contexts = ({ children, terms = [], variables = { user: {}, defaults: [] }
 };
 /* harmony default export */ const contexts = (Contexts);
 
-;// ./utils/user.ts
-const User = (variables) => {
-    const { user = {}, defaults = [] } = variables || {};
-    return new Proxy(user, {
-        get(target, attribute) {
-            if (typeof attribute === 'symbol') {
-                return '';
-            }
-            if (attribute in target) {
-                return target[attribute];
-            }
-            const def = defaults.find((d) => d.name === attribute);
-            return def ? def.default : attribute.toUpperCase();
-        },
-    });
-};
-/* harmony default export */ const user = (User);
-
 ;// ./lib/utils/makeUseMdxComponents.ts
 
 
@@ -107528,6 +107681,7 @@ const makeUseMDXComponents = (more = {}) => {
 
 ;// ./lib/utils/mdxish/mdxish-variables.ts
 
+
 // The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
 // substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
 // which either evaluated already or is meant to stay literal.
@@ -107551,7 +107705,7 @@ function resolveAttributeVariables(value, user) {
         .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
         if (escapePrefix || escapeSuffix)
             return source;
-        return user[name];
+        return stringifyVariableValue(user[name]);
     });
 }
 
@@ -107827,7 +107981,8 @@ const run_run = (string, _opts = {}) => {
 
 const tags = (doc) => {
     const set = new Set();
-    visit(lib_mdast(doc), isMDXElement, (node) => {
+    // Tag names never depend on evaluated attribute values, so always parse in safeMode.
+    visit(lib_mdast(doc, { safeMode: true }), isMDXElement, (node) => {
         if (node.name?.match(/^[A-Z]/)) {
             set.add(node.name);
         }
@@ -107843,13 +107998,14 @@ const tags = (doc) => {
 
 
 
-const { micromarkExtensions, fromMarkdownExtensions } = mdxishExtensions(FEATURES.tags);
+const { micromarkExtensions, fromMarkdownExtensions } = mdxishExtensions(FEATURES.tags, { safeMode: true });
 const mdxishTags_tags = (doc) => {
     const set = new Set();
     const processor = remark()
         .data('micromarkExtensions', micromarkExtensions)
         .data('fromMarkdownExtensions', fromMarkdownExtensions)
-        .use(mdx_blocks)
+        // Tag names never depend on evaluated attribute values, so always parse in safeMode.
+        .use(mdx_blocks, { safeMode: true })
         .use(mdxish_tables);
     const tree = processor.parse(doc);
     visit(processor.runSync(tree), isMDXElement, (node) => {

package/dist/main.node.js

@@ -74989,12 +74989,104 @@ const mdast = (text, opts = {}) => {
  */
 const jsxAcornParser = Parser.extend(acorn_jsx_default()());
 
+;// ./lib/utils/literal-expression.ts
+
+const unsupported = (description) => new Error(`not a literal expression: ${description}`);
+/** Narrows a resolved value for arithmetic, so operands never coerce to `NaN` or `"[object Object]"`. */
+const asNumber = (value) => {
+    if (typeof value !== 'number')
+        throw unsupported('non-numeric operand');
+    return value;
+};
+const asOperand = (value) => {
+    if (typeof value !== 'number' && typeof value !== 'string')
+        throw unsupported('non-primitive operand');
+    return value;
+};
+const ARITHMETIC_OPERATORS = {
+    // `+` doubles as string concatenation, so it accepts a string on either side.
+    '+': (left, right) => (typeof left === 'number' && typeof right === 'number' ? left + right : `${left}${right}`),
+    '-': (left, right) => asNumber(left) - asNumber(right),
+    '*': (left, right) => asNumber(left) * asNumber(right),
+    '/': (left, right) => asNumber(left) / asNumber(right),
+};
+/** Resolve one estree node, recursing into arrays and objects. Throws for anything not on the allowlist. */
+const resolveNode = (node) => {
+    switch (node.type) {
+        case 'Literal':
+            // Regex and bigint `Literal`s hold values a tree consumer can't serialise;
+            // a BigInt throws outright in `JSON.stringify`.
+            if ('regex' in node || 'bigint' in node)
+                throw unsupported('regex or bigint literal');
+            return node.value;
+        case 'Identifier':
+            if (node.name !== 'undefined')
+                throw unsupported(`identifier \`${node.name}\``);
+            return undefined;
+        case 'TemplateLiteral':
+            if (node.expressions.length)
+                throw unsupported('template substitution');
+            return node.quasis.map(quasi => quasi.value.cooked).join('');
+        case 'UnaryExpression':
+            if (node.operator !== '-')
+                throw unsupported(`operator \`${node.operator}\``);
+            return -asNumber(resolveNode(node.argument));
+        case 'BinaryExpression': {
+            const applyOperator = ARITHMETIC_OPERATORS[node.operator];
+            if (!applyOperator)
+                throw unsupported(`operator \`${node.operator}\``);
+            return applyOperator(asOperand(resolveNode(node.left)), asOperand(resolveNode(node.right)));
+        }
+        case 'ArrayExpression':
+            return node.elements.map(element => (element === null ? null : resolveNode(element)));
+        case 'ObjectExpression':
+            return node.properties.reduce((memo, property) => {
+                if (property.type !== 'Property' || property.computed)
+                    throw unsupported('computed or spread property');
+                const { key } = property;
+                if (key.type !== 'Identifier' && key.type !== 'Literal')
+                    throw unsupported('property key');
+                const name = key.type === 'Identifier' ? key.name : String(key.value);
+                // `__proto__` would replace the object's prototype rather than add a property.
+                if (name === '__proto__')
+                    throw unsupported('`__proto__` key');
+                memo[name] = resolveNode(property.value);
+                return memo;
+            }, {});
+        default:
+            throw unsupported(node.type);
+    }
+};
+/**
+ * Resolve a JSX attribute expression's source to its value without executing it.
+ *
+ * Supports the literal syntax attributes actually use — `true`, `"a"`, `` `a` ``,
+ * `undefined`, `{ textAlign: "left" }`, `["left"]`, `1 + 1`, `'https://' + 'x.com'` —
+ * and refuses everything else, so no identifier, member access, call, assignment or
+ * function body can ever run. The trade-off is that expressions needing a scope or a
+ * method call (`{item.url}`, `{"a".toUpperCase()}`) throw, and callers keep the raw
+ * source instead — the same fallback they already used for an expression that threw.
+ * mdxish rendering is unaffected, since it resolves those later with its scoped
+ * evaluator; only consumers reading attributes straight off the tree see the source.
+ *
+ * @param source expression body, without the surrounding braces
+ * @throws if `source` is unparseable or isn't a supported literal expression
+ */
+const evaluateLiteralExpression = (source) => {
+    const expression = jsxAcornParser.parseExpressionAt(source, 0, { ecmaVersion: 'latest' });
+    // acorn stops at the first complete expression, so anything trailing means this isn't one.
+    if (expression.end !== source.trimEnd().length)
+        throw unsupported('trailing content');
+    return resolveNode(expression);
+};
+
 ;// ./processor/utils.ts
 
 
 
 
 
+
 /**
  * Evaluate a JavaScript expression source and return its value.
  *
@@ -75092,8 +75184,10 @@ const getAttrs = (jsx) => jsx.attributes.reduce((memo, attr) => {
             memo[attr.name] = decode_decodeHTMLStrict(attr.value);
         }
         else if (attr.value?.value !== undefined) {
+            // Expression values only survive to here when safeMode is off; `flattenAttributeExpressions`
+            // rewrites them to plain strings at the head of the pipeline otherwise.
             try {
-                memo[attr.name] = evaluate(attr.value.value);
+                memo[attr.name] = evaluateLiteralExpression(attr.value.value);
             }
             catch {
                 memo[attr.name] = attr.value.value;
@@ -75874,6 +75968,31 @@ const embedTransformer = () => {
 };
 /* harmony default export */ const transform_embeds = (embedTransformer);
 
+;// ./processor/transform/flatten-attribute-expressions.ts
+
+
+/**
+ * Rewrites JSX attribute expressions (`icon={String(1 + 3)}`) into plain string attributes
+ * holding their literal source, so nothing downstream can evaluate them.
+ *
+ * This is the RMDX counterpart to mdxish's `preserveExpressionsAsText` parse option: safeMode's
+ * contract is enforced once, at the head of the pipeline, rather than at every `getAttrs()` call
+ * site. Only registered when safeMode is on.
+ */
+const flattenAttributeExpressions = () => tree => {
+    visit(tree, isMDXElement, (node) => {
+        node.attributes.forEach(attr => {
+            if (!('name' in attr))
+                return;
+            if (attr.value === null || typeof attr.value === 'string')
+                return;
+            attr.value = attr.value.value;
+        });
+    });
+    return tree;
+};
+/* harmony default export */ const flatten_attribute_expressions = (flattenAttributeExpressions);
+
 ;// ./node_modules/gemoji/index.js
 /**
  * @typedef Gemoji
@@ -101643,6 +101762,7 @@ const variables = ({ asMdx } = { asMdx: true }) => tree => {
 
 
 
+
 const defaultTransforms = {
     calloutTransformer: callouts,
     codeTabsTransformer: code_tabs,
@@ -101670,6 +101790,9 @@ const astProcessor = (opts = {}) => {
     const components = opts.components || {};
     let processor = remark()
         .use(remarkMdx)
+        // Must precede every other transformer: it strips evaluable attribute expressions so no
+        // downstream `getAttrs()` call can reach `evaluate()`.
+        .use(opts.safeMode ? flatten_attribute_expressions : undefined)
         .use(remarkPlugins)
         .use(opts.remarkPlugins)
         .use(transform_variables, { asMdx: false })
@@ -116249,12 +116372,59 @@ const hastscript_lib_h = create_h_createH(node_modules_property_information_html
 /** @type {ReturnType<createH>} */
 const lib_s = create_h_createH(node_modules_property_information_svg, 'g', svg_case_sensitive_tag_names_svgCaseSensitiveTagNames)
 
+;// ./utils/user.ts
+/**
+ * Coerce a user variable value to a string for substitution into markdown text.
+ * Non-string values (arrays, objects, numbers) are stringified via JSON or `String()`
+ * so that `<<var>>` syntax doesn't produce `[object Object]` for structured data like
+ * JWT `keys`.
+ */
+const stringifyVariableValue = (value) => {
+    if (typeof value === 'string')
+        return value;
+    if (value == null)
+        return '';
+    if (typeof value === 'object') {
+        try {
+            return JSON.stringify(value) ?? '';
+        }
+        catch {
+            console.warn('[WARNING] Could not stringify a structured user variable.');
+            return '';
+        }
+    }
+    return String(value);
+};
+/**
+ * Flatten `variables.user` into a string-keyed string-valued record by coercing
+ * each value. Used by markdown substitution paths that need a plain
+ * `Record<string, string>` lookup.
+ */
+const flattenUserVariables = (user) => Object.fromEntries(Object.entries(user).map(([name, value]) => [name, stringifyVariableValue(value)]));
+const User = (variables) => {
+    const { user = {}, defaults = [] } = variables || {};
+    return new Proxy(user, {
+        get(target, attribute) {
+            if (typeof attribute === 'symbol') {
+                return '';
+            }
+            if (attribute in target) {
+                return target[attribute];
+            }
+            const def = defaults.find((d) => d.name === attribute);
+            return def ? def.default : attribute.toUpperCase();
+        },
+    });
+};
+/* harmony default export */ const user = (User);
+
 ;// ./processor/plugin/toc.ts
 
 
 
 
 
+
 const HEADING_TAGS = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6'];
 const isHeadingTag = (tag) => (tag ? HEADING_TAGS.includes(tag) : false);
 const isStandardHtmlElement = (node) => STANDARD_HTML_TAGS.has(node.tagName.toLowerCase());
@@ -116366,7 +116536,7 @@ const flattenVariables = (variables) => {
     if (!variables)
         return {};
     return {
-        ...variables.user,
+        ...flattenUserVariables(variables.user),
         ...Object.fromEntries((variables.defaults || []).filter(d => !(d.name in variables.user)).map(d => [d.name, d.default])),
     };
 };
@@ -116514,7 +116684,7 @@ const exports_exports = (doc) => {
 
 const hast = (text, opts = {}) => {
     const components = Object.entries(opts.components || {}).reduce((memo, [name, doc]) => {
-        memo[name] = lib_mdast(doc);
+        memo[name] = lib_mdast(doc, { safeMode: opts.safeMode });
         return memo;
     }, {});
     const processor = ast_processor(opts)
@@ -127150,6 +127320,7 @@ function normalizeTableSeparator(content) {
 ;// ./processor/transform/mdxish/variables-code.ts
 
 
+
 // Single combined regex so that resolved values from one pattern are never re-scanned by the other.
 const COMBINED_VARIABLE_REGEX = new RegExp(`${variable_dist.VARIABLE_REGEXP}|${variable_dist.MDX_VARIABLE_REGEXP}`, 'giu');
 // Flatten variables into a single object for easy lookup
@@ -127158,7 +127329,7 @@ function variables_code_flattenVariables(variables) {
         return {};
     return {
         ...Object.fromEntries((variables.defaults || []).map(d => [d.name, d.default])),
-        ...variables.user,
+        ...flattenUserVariables(variables.user),
     };
 }
 function resolveCodeVariables(value, resolvedVariables) {
@@ -127702,24 +127873,6 @@ const Contexts = ({ children, terms = [], variables = { user: {}, defaults: [] }
 };
 /* harmony default export */ const contexts = (Contexts);
 
-;// ./utils/user.ts
-const User = (variables) => {
-    const { user = {}, defaults = [] } = variables || {};
-    return new Proxy(user, {
-        get(target, attribute) {
-            if (typeof attribute === 'symbol') {
-                return '';
-            }
-            if (attribute in target) {
-                return target[attribute];
-            }
-            const def = defaults.find((d) => d.name === attribute);
-            return def ? def.default : attribute.toUpperCase();
-        },
-    });
-};
-/* harmony default export */ const user = (User);
-
 ;// ./lib/utils/makeUseMdxComponents.ts
 
 
@@ -127752,6 +127905,7 @@ const makeUseMDXComponents = (more = {}) => {
 
 ;// ./lib/utils/mdxish/mdxish-variables.ts
 
+
 // The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
 // substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
 // which either evaluated already or is meant to stay literal.
@@ -127775,7 +127929,7 @@ function resolveAttributeVariables(value, user) {
         .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
         if (escapePrefix || escapeSuffix)
             return source;
-        return user[name];
+        return stringifyVariableValue(user[name]);
     });
 }
 
@@ -128051,7 +128205,8 @@ const run_run = (string, _opts = {}) => {
 
 const tags = (doc) => {
     const set = new Set();
-    visit(lib_mdast(doc), isMDXElement, (node) => {
+    // Tag names never depend on evaluated attribute values, so always parse in safeMode.
+    visit(lib_mdast(doc, { safeMode: true }), isMDXElement, (node) => {
         if (node.name?.match(/^[A-Z]/)) {
             set.add(node.name);
         }
@@ -128067,13 +128222,14 @@ const tags = (doc) => {
 
 
 
-const { micromarkExtensions, fromMarkdownExtensions } = mdxishExtensions(FEATURES.tags);
+const { micromarkExtensions, fromMarkdownExtensions } = mdxishExtensions(FEATURES.tags, { safeMode: true });
 const mdxishTags_tags = (doc) => {
     const set = new Set();
     const processor = remark()
         .data('micromarkExtensions', micromarkExtensions)
         .data('fromMarkdownExtensions', fromMarkdownExtensions)
-        .use(mdx_blocks)
+        // Tag names never depend on evaluated attribute values, so always parse in safeMode.
+        .use(mdx_blocks, { safeMode: true })
         .use(mdxish_tables);
     const tree = processor.parse(doc);
     visit(processor.runSync(tree), isMDXElement, (node) => {