@readme/markdown 15.7.3 → 15.9.0

package/dist/main.js

@@ -11423,7 +11423,7 @@ module.exports = function () {
 
 /***/ },
 
-/***/ 7070
+/***/ 9171
 (module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -12156,9 +12156,9 @@ const HTMLBlock = ({ children = '', html: htmlProp, runScripts, safeMode: safeMo
     const safeMode = typeof safeModeRaw !== 'boolean' ? safeModeRaw === 'true' : safeModeRaw;
     const [cleanedHtml, exec] = extractScripts(html);
     (0,external_amd_react_commonjs_react_commonjs2_react_root_React_umd_react_.useEffect)(() => {
-        if (typeof window !== 'undefined' && typeof runScripts === 'boolean' && runScripts)
+        if (typeof window !== 'undefined' && typeof runScripts === 'boolean' && runScripts && !safeMode)
             exec();
-    }, [runScripts, exec]);
+    }, [runScripts, safeMode, exec]);
     if (nonStringChildren) {
         // Fail soft: a non-string child (e.g. JSX that wasn't serialized back to a
         // raw string) should never throw, so render the child nodes directly
@@ -94009,6 +94009,133 @@ const hardBreaks = () => tree => {
 };
 /* harmony default export */ const hard_breaks = (hardBreaks);
 
+;// ./processor/plugin/strip-tags.ts
+
+/**
+ * Tags removed from user-provided content because rendering them executes in the
+ * page. Add an entry to cover another vector; nothing else needs to change.
+ *
+ * Deliberately narrow for now — `<script>` is the only vector this plugin claims
+ * to close. Broader parity with the `md` sanitization schema (`javascript:` URLs,
+ * `on*` handlers, `<iframe>`, `<object>`, …) is tracked in readmeio/markdown#1526.
+ */
+const STRIPPED_TAG_NAMES = new Set(['script']);
+/** JSX names starting with a capital are component references, not literal tags. */
+const LITERAL_TAG_NAME = /^[a-z]/;
+/**
+ * Whether a node would render as one of the stripped literal DOM elements.
+ * Browsers match tag names case-insensitively, so `<sCrIpT>` executes too.
+ *
+ * `<Script />` and friends are component references and are left alone.
+ */
+const isStrippedTag = (node) => {
+    if (node.type === 'element')
+        return STRIPPED_TAG_NAMES.has(node.tagName.toLowerCase());
+    if (node.type === 'mdxJsxFlowElement' || node.type === 'mdxJsxTextElement') {
+        const name = node.name ?? '';
+        return LITERAL_TAG_NAME.test(name) && STRIPPED_TAG_NAMES.has(name.toLowerCase());
+    }
+    return false;
+};
+/**
+ * Removes matching elements and their subtrees when `sanitize` is enabled.
+ *
+ * Explicit `HTMLBlock`s are an intentional exception, matching legacy: their
+ * scripts live in a string prop rather than as elements, so they never appear
+ * in SSR HTML, and they only execute client-side when the author opts in via
+ * `runScripts`.
+ */
+const rehypeStripTags = () => {
+    return (tree) => {
+        visit(tree, isStrippedTag, (_node, index, parent) => {
+            parent.children.splice(index, 1);
+            return [(/* inlined export .SKIP */"skip"), index];
+        });
+    };
+};
+/** The automatic-runtime factories MDX compiles JSX into. */
+const JSX_FACTORIES = new Set(['_jsx', '_jsxs', '_jsxDEV']);
+/**
+ * Matches raw JSX and compiled `_jsx('tag', …)` calls. MDX may rewrite literal
+ * tags as `_components.<tag>` so a `components` prop can override them.
+ */
+const isStrippedJsxElement = (node) => {
+    if (node.type === 'JSXElement') {
+        const { name } = node.openingElement;
+        if (name.type === 'JSXIdentifier') {
+            return LITERAL_TAG_NAME.test(name.name) && STRIPPED_TAG_NAMES.has(name.name.toLowerCase());
+        }
+        return (name.type === 'JSXMemberExpression' &&
+            name.object.type === 'JSXIdentifier' &&
+            name.object.name === '_components' &&
+            STRIPPED_TAG_NAMES.has(name.property.name.toLowerCase()));
+    }
+    if (node.type === 'CallExpression' && node.callee.type === 'Identifier' && JSX_FACTORIES.has(node.callee.name)) {
+        const [tag] = node.arguments;
+        if (!tag)
+            return false;
+        if (tag.type === 'Literal')
+            return typeof tag.value === 'string' && STRIPPED_TAG_NAMES.has(tag.value.toLowerCase());
+        return (tag.type === 'MemberExpression' &&
+            tag.object.type === 'Identifier' &&
+            tag.object.name === '_components' &&
+            tag.property.type === 'Identifier' &&
+            STRIPPED_TAG_NAMES.has(tag.property.name.toLowerCase()));
+    }
+    return false;
+};
+const isEstreeNode = (value) => typeof value === 'object' && value !== null && typeof value.type === 'string';
+const nullLiteral = () => ({ type: 'Literal', value: null });
+/**
+ * JSX inside expressions and exports stays in ESTree, outside the HAST pass.
+ * Strip it before evaluation in mdxish or after JSX compilation in MDX.
+ *
+ * Elements are spliced out of JSX children and replaced with `null` anywhere
+ * else, which React renders as nothing.
+ */
+const stripJsxTags = (program) => {
+    const walk = (node) => {
+        const record = node;
+        Object.keys(record).forEach(key => {
+            if (key === 'loc' || key === 'range' || key === 'position')
+                return;
+            const value = record[key];
+            if (Array.isArray(value)) {
+                for (let i = value.length - 1; i >= 0; i -= 1) {
+                    const child = value[i];
+                    if (isEstreeNode(child)) {
+                        if (isStrippedJsxElement(child)) {
+                            if (key === 'children')
+                                value.splice(i, 1);
+                            else
+                                value[i] = nullLiteral();
+                        }
+                        else {
+                            walk(child);
+                        }
+                    }
+                }
+                return;
+            }
+            if (!isEstreeNode(value))
+                return;
+            if (isStrippedJsxElement(value)) {
+                record[key] =
+                    node.type === 'JSXAttribute' ? { type: 'JSXExpressionContainer', expression: nullLiteral() } : nullLiteral();
+            }
+            else {
+                walk(value);
+            }
+        });
+    };
+    walk(program);
+    return program;
+};
+/** `stripJsxTags` as a recma plugin, for the `mdx` compile pipeline. */
+const recmaStripTags = () => tree => {
+    stripJsxTags(tree);
+};
+
 ;// ./node_modules/estree-util-value-to-estree/dist/estree-util-value-to-estree.js
 /**
  * Create an ESTree identifier node for a given name.
@@ -96746,6 +96873,7 @@ const tocHastToMdx = (toc, components, variables) => {
 
 
 
+
 const sanitizeSchema = cjs_default()(defaultSchema, {
     attributes: {
         a: ['target'],
@@ -96754,7 +96882,10 @@ const sanitizeSchema = cjs_default()(defaultSchema, {
         href: ['doc', 'ref', 'blog', 'changelog', 'page'],
     },
 });
-const compile_compile = (text, { components = {}, missingComponents, copyButtons, useTailwind, hardBreaks, ...opts } = {}) => {
+const compile_compile = (text, { components = {}, missingComponents, copyButtons, useTailwind, hardBreaks, sanitize = false, 
+// Pulled out of `...opts` so a caller's plugins extend the pipeline instead of
+// replacing it — otherwise the spread below would drop `rehypeStripTags`.
+remarkPlugins: userRemarkPlugins, rehypePlugins: userRehypePlugins, recmaPlugins: userRecmaPlugins, ...opts } = {}) => {
     // Destructure at runtime to avoid circular dependency issues
     const { codeTabsTransformer, ...transforms } = defaultTransforms;
     const remarkPlugins = [
@@ -96772,7 +96903,12 @@ const compile_compile = (text, { components = {}, missingComponents, copyButtons
     if (useTailwind) {
         remarkPlugins.push([transform_tailwind, { components }]);
     }
-    const rehypePlugins = [...ast_processor_rehypePlugins, [rehypeToc, { components }]];
+    remarkPlugins.push(...(userRemarkPlugins ?? []));
+    const rehypePlugins = [
+        ...ast_processor_rehypePlugins,
+        [rehypeToc, { components }],
+        ...(userRehypePlugins ?? []),
+    ];
     if (opts.format === 'md') {
         /**
          * When running in `md` format we need to sanitize the content for security reasons.
@@ -96790,12 +96926,23 @@ const compile_compile = (text, { components = {}, missingComponents, copyButtons
         ]);
         rehypePlugins.push([rehypeSanitize, sanitizeSchema]);
     }
+    const recmaPlugins = [...(userRecmaPlugins ?? [])];
+    // In `mdx` format a literal <script> parses as JSX rather than raw HTML, so it
+    // bypasses sanitization entirely — strip it in every format. Must stay last:
+    // in `md` format raw HTML isn't an element until `rehypeRaw` has run. A tag
+    // inside an expression or export is code, not an element, so the recma pass
+    // catches it in the compiled program instead.
+    if (sanitize) {
+        rehypePlugins.push(rehypeStripTags);
+        recmaPlugins.push(recmaStripTags);
+    }
     try {
         const vfile = compileSync(text, {
             outputFormat: 'function-body',
             providerImportSource: '#',
             remarkPlugins,
             rehypePlugins,
+            recmaPlugins,
             ...opts,
         });
         const string = String(vfile)
@@ -103741,6 +103888,32 @@ const mdxComponentHandlers = {
     [NodeTypes.htmlBlock]: htmlBlockHandler,
 };
 
+;// ./processor/plugin/safe-mode-html-blocks.ts
+
+
+/**
+ * Whether a tag name renders through the `HTMLBlock` component. Mirrors the
+ * separator-agnostic, case-insensitive lookup in `getComponentName` and the
+ * rehype-react component map, so `html-block`, `HTMLBlock`, `HtmlBlock` and
+ * `htmlblock` all match.
+ */
+const isHtmlBlockTag = (tagName) => toPascalCase(tagName).toLowerCase() === 'htmlblock';
+/**
+ * Forces `safeMode` on every element that renders through `HTMLBlock` so it is
+ * shown as escaped text instead of injected.
+ *
+ * Runs last, so it sees every producer of the element — `[block:html]`,
+ * `<HTMLBlock>` with a template body or an `html` attribute, and a literal
+ * `<html-block>` — and it is unconditional so an author-supplied
+ * `safeMode="false"` can't opt out.
+ */
+const enforceSafeModeHtmlBlocks = () => tree => {
+    visit(tree, 'element', node => {
+        if (isHtmlBlockTag(node.tagName))
+            node.properties.safeMode = 'true';
+    });
+};
+
 ;// ./processor/transform/mdxish/anchor-to-jsx.ts
 
 
@@ -105052,6 +105225,7 @@ const collectImportValues = (importDeclarations, registry = defaultModuleRegistr
 
 
 
+
 /**
  * Recursively extract all identifier names introduced by a binding pattern.
  * Handles destructuring (`{ a, b }`, `[x, y]`), rest elements (`...rest`),
@@ -105096,7 +105270,7 @@ const collectExportNames = (declaration) => {
  * Any evaluation error is consumed and logged. We don't throw because it's
  * against the spirit of this engine to be less permissive than MDX needs.
  */
-const evaluateExports = () => (tree, file) => {
+const evaluateExports = (opts) => (tree, file) => {
     const programBody = [];
     const exportNames = [];
     const importDeclarations = [];
@@ -105142,6 +105316,8 @@ const evaluateExports = () => (tree, file) => {
     // Evaluate the declarations together at once in a single sandboxed Function
     try {
         const program = { type: 'Program', sourceType: 'module', body: programBody };
+        if (opts?.sanitize)
+            stripJsxTags(program);
         buildJsx(program, { runtime: 'classic', pragma: 'React.createElement', pragmaFrag: 'React.Fragment' });
         const { value: source } = toJs(program);
         // Make sure import values are available in the scope
@@ -106045,7 +106221,7 @@ const parseApiHeaderTitle = (text) => {
  * Transform a magicBlock node into final MDAST nodes.
  */
 function transformMagicBlock(blockType, data, rawValue, options = {}) {
-    const { compatibilityMode = false, hardBreaks = true, safeMode = false } = options;
+    const { compatibilityMode = false, hardBreaks = true } = options;
     // Handle empty data by returning placeholder nodes for known block types
     // This allows the editor to show appropriate placeholder UI instead of nothing
     if (Object.keys(data).length < 1) {
@@ -106263,7 +106439,7 @@ function transformMagicBlock(blockType, data, rawValue, options = {}) {
                 wrapPinnedBlocks({
                     data: {
                         hName: 'html-block',
-                        hProperties: { html: htmlJson.html, runScripts: compatibilityMode, safeMode },
+                        hProperties: { html: htmlJson.html, runScripts: compatibilityMode },
                     },
                     type: 'html-block',
                 }, data),
@@ -106523,6 +106699,80 @@ const mdxishHtmlBlocks = () => tree => {
 };
 /* harmony default export */ const mdxish_html_blocks = (mdxishHtmlBlocks);
 
+;// ./processor/transform/mdxish/tables/cell-width.ts
+
+
+// Key must follow `{` or `,` so `minWidth`/`maxWidth` don't match on their suffix
+const STYLE_OBJECT_WIDTH_REGEX = /[{,]\s*["']?width["']?\s*:\s*(?:"([^"]*)"|'([^']*)'|([^,}]+))/i;
+// First colon only, so `url(http://…)` values stay intact
+const CSS_DECLARATION_REGEX = /:(.*)/s;
+const UNITLESS_NUMBER_REGEX = /^\d+(?:\.\d+)?$/;
+// HTML reads a `width` attribute as a leading number plus optional `%`, ignoring the rest
+const HTML_DIMENSION_REGEX = /^\s*(\d+(?:\.\d+)?)\s*(%?)/;
+/** Bare numbers are pixels. A value carrying declaration separators is not a single width. */
+const normalizeWidth = (value) => {
+    if (typeof value === 'number')
+        return `${value}px`;
+    if (typeof value !== 'string' || !value.trim())
+        return null;
+    const trimmed = value.trim();
+    if (/[;:{}]/.test(trimmed))
+        return null;
+    return UNITLESS_NUMBER_REGEX.test(trimmed) ? `${trimmed}px` : trimmed;
+};
+const widthFromAttribute = (value) => {
+    if (typeof value === 'number')
+        return `${value}px`;
+    if (typeof value !== 'string')
+        return null;
+    const match = HTML_DIMENSION_REGEX.exec(value);
+    return match ? `${match[1]}${match[2] || 'px'}` : null;
+};
+const cssPropertyNames = (style) => style
+    .split(';')
+    .map(declaration => declaration.split(CSS_DECLARATION_REGEX)[0].trim().toLowerCase())
+    .filter(Boolean);
+/** Handles a CSS declaration list and a style object safe mode left as a string (`{ width: "30%" }`). */
+const widthFromStyleString = (style) => {
+    const trimmed = style.trim();
+    if (trimmed.startsWith('{')) {
+        return STYLE_OBJECT_WIDTH_REGEX.exec(trimmed)?.slice(1).find(Boolean);
+    }
+    return trimmed
+        .split(';')
+        .map(declaration => declaration.split(CSS_DECLARATION_REGEX))
+        .find(([property]) => property.trim().toLowerCase() === 'width')?.[1];
+};
+/** Accepts `style={{ width }}`, `style="width: …"` and the hand-authored `width="…"`. */
+const getCellWidth = (cell) => {
+    const { style, width } = getAttrs(cell);
+    let styleWidth;
+    if (style_object_to_css_isPlainObject(style)) {
+        styleWidth = style.width;
+    }
+    else if (typeof style === 'string') {
+        styleWidth = widthFromStyleString(style);
+    }
+    return normalizeWidth(styleWidth) ?? widthFromAttribute(width);
+};
+/** True when the cell's attributes state nothing but its width, which mdast can carry. */
+const hasOnlyWidthAttributes = (cell) => {
+    if (cell.attributes.length === 0)
+        return false;
+    const { style } = getAttrs(cell);
+    return cell.attributes.every(attribute => {
+        if (!('name' in attribute))
+            return false;
+        if (attribute.name === 'width')
+            return true;
+        if (attribute.name !== 'style')
+            return false;
+        if (style_object_to_css_isPlainObject(style))
+            return Object.keys(style).every(key => key === 'width');
+        return typeof style === 'string' && cssPropertyNames(style).every(property => property === 'width');
+    });
+};
+
 ;// ./processor/transform/mdxish/mdxish-jsx-to-mdast.ts
 
 
@@ -106530,6 +106780,7 @@ const mdxishHtmlBlocks = () => tree => {
 
 
 
+
 function toImageAlign(value) {
     if (value === 'left' || value === 'center' || value === 'right') {
         return value;
@@ -106971,10 +107222,40 @@ const wrapBareCellsInRow = (node) => {
     });
 };
 /**
- * Converts a JSX <Table> element to an MDAST table node with alignment.
- * Returns null for header-less tables since MDAST always promotes the first row to <thead>.
+ * A lowercase <table> reaches here only because `mdxishTables` kept it as JSX for its
+ * attributes. Widths on first-row cells are the one attribute mdast can carry; anything
+ * else stays JSX so it still renders.
+ */
+const lowercaseTableIsConvertible = (jsx) => {
+    if (jsx.attributes.length > 0)
+        return false;
+    const headerCells = new Set();
+    let headerRowSeen = false;
+    let convertible = true;
+    visit(jsx, isMDXElement, (child) => {
+        if (child.name === 'tr' && !headerRowSeen) {
+            headerRowSeen = true;
+            visit(child, mdxish_jsx_to_mdast_isTableCell, cell => {
+                headerCells.add(cell);
+            });
+        }
+        if (child.name === null || !tableTags.has(child.name) || child.attributes.length === 0)
+            return;
+        if (!headerCells.has(child) || !hasOnlyWidthAttributes(child) || getCellWidth(child) === null) {
+            convertible = false;
+        }
+    });
+    return convertible;
+};
+/**
+ * Converts a JSX <Table>, or a lowercase <table> carrying only widths, to an MDAST table
+ * node with alignment and widths. Returns null for header-less tables since MDAST always
+ * promotes the first row to <thead>.
  */
 const transformTable = (jsx) => {
+    const isLowercase = jsx.name === 'table';
+    if (isLowercase && !lowercaseTableIsConvertible(jsx))
+        return null;
     wrapBareCellsInRow(jsx);
     let hasThead = false;
     visit(jsx, isMDXElement, (child) => {
@@ -106986,6 +107267,7 @@ const transformTable = (jsx) => {
     const { align: alignAttr } = getAttrs(jsx);
     const align = Array.isArray(alignAttr) ? alignAttr : null;
     const rows = [];
+    const widths = [];
     visit(jsx, isMDXElement, (child) => {
         if (child.name !== 'thead' && child.name !== 'tbody')
             return;
@@ -106993,6 +107275,7 @@ const transformTable = (jsx) => {
             if (row.name !== 'tr')
                 return;
             const cells = [];
+            const isHeaderRow = rows.length === 0;
             visit(row, mdxish_jsx_to_mdast_isTableCell, (cell) => {
                 const parsedChildren = unwrapSoleParagraph(cell.children);
                 cells.push({
@@ -107000,6 +107283,8 @@ const transformTable = (jsx) => {
                     children: parsedChildren,
                     position: cell.position,
                 });
+                if (isHeaderRow)
+                    widths.push(getCellWidth(cell));
             });
             rows.push({
                 type: 'tableRow',
@@ -107012,11 +107297,16 @@ const transformTable = (jsx) => {
     const alignArray = align && columnCount > 0
         ? align.slice(0, columnCount).concat(Array.from({ length: Math.max(0, columnCount - align.length) }, () => null))
         : Array.from({ length: columnCount }, () => null);
+    const data = {
+        ...(isLowercase && { lowercaseTable: true }),
+        ...(widths.some(Boolean) && { widths }),
+    };
     return {
         type: 'table',
         align: alignArray,
         position: jsx.position,
         children: rows,
+        ...(Object.keys(data).length > 0 && { data }),
     };
 };
 /**
@@ -107046,6 +107336,7 @@ const COMPONENT_MAP = {
     figure: transformFigure,
     Recipe: transformRecipe,
     Table: transformTable,
+    table: transformTable,
 };
 /**
  * Transform mdxJsxFlowElement nodes, magic block nodes, and HTML figure elements
@@ -107521,6 +107812,28 @@ const restoreBooleanProperties = () => tree => {
 };
 
 
+;// ./processor/transform/mdxish/tables/cell-style.ts
+/** `left` is the browser default, so it's omitted. Lowercase tables get the HTML string form. */
+const cellStyle = (align, width = null, { html = false } = {}) => {
+    if (html) {
+        if (!width)
+            return null;
+        return { type: 'mdxJsxAttribute', name: 'style', value: `width: ${width}` };
+    }
+    const declarations = [];
+    if (align && align !== 'left')
+        declarations.push(`textAlign: ${JSON.stringify(align)}`);
+    if (width)
+        declarations.push(`width: ${JSON.stringify(width)}`);
+    if (declarations.length === 0)
+        return null;
+    return {
+        type: 'mdxJsxAttribute',
+        name: 'style',
+        value: { type: 'mdxJsxAttributeValueExpression', value: `{ ${declarations.join(', ')} }` },
+    };
+};
+
 ;// ./processor/transform/mdxish/tables/gfm-cell-normalization.ts
 /** `<br />` is the only line break a GFM pipe cell can carry, since cells are single-line. */
 const createLineBreak = () => ({
@@ -107559,19 +107872,8 @@ const normalizeCellChildrenForGfm = (cell) => normalizeNodes(cell.children);
 
 
 
+
 const SELF_CLOSING_JSX_REGEX = /^\s*<[A-Z][^>]*\/>\s*$/;
-const mdxish_tables_to_jsx_alignToStyle = (align) => {
-    if (!align || align === 'left')
-        return null;
-    return {
-        type: 'mdxJsxAttribute',
-        name: 'style',
-        value: {
-            type: 'mdxJsxAttributeValueExpression',
-            value: `{ textAlign: "${align}" }`,
-        },
-    };
-};
 const mdxish_tables_to_jsx_isTableCell = (node) => ['tableHead', 'tableCell'].includes(node.type);
 const mdxish_tables_to_jsx_isLiteral = (node) => 'value' in node;
 /**
@@ -107627,12 +107929,17 @@ const mdxishTablesToJsx = () => tree => {
             gfmCells.push([cell, normalized]);
             return undefined;
         });
-        const stayLowercase = table.data?.lowercaseTable === true;
+        const widths = table.data?.widths ?? [];
+        const hasWidths = widths.some(Boolean);
+        // Lowercase cells can carry a width but not an alignment, so an aligned table becomes <Table>
+        const hasAlignment = table.align.some(align => align && align !== 'left');
+        const stayLowercase = table.data?.lowercaseTable === true && !hasAlignment;
         // We transform to GFM tables if:
         // 1. If it doesn't contain complex elements that the syntax can't represent
-        // 2. The original table is not lowercase HTML <table>, because we want to 
+        // 2. The original table is not lowercase HTML <table>, because we want to
         // preserve original tables as much as possible
-        if (!requiresJsxTable && !stayLowercase) {
+        // 3. No column has a width, which GFM can't express
+        if (!requiresJsxTable && !stayLowercase && !hasWidths) {
             gfmCells.forEach(([cell, children]) => {
                 cell.children = children;
             });
@@ -107644,7 +107951,8 @@ const mdxishTablesToJsx = () => tree => {
         if (!headerRow)
             return;
         visit(table, mdxish_tables_to_jsx_isTableCell, flattenBreaksToNewlines);
-        const styles = table.align.map(mdxish_tables_to_jsx_alignToStyle);
+        const headerStyles = table.align.map((align, i) => cellStyle(align, widths[i] ?? null, { html: stayLowercase }));
+        const bodyStyles = table.align.map(align => cellStyle(align, null, { html: stayLowercase }));
         const head = {
             attributes: [],
             type: 'mdxJsxFlowElement',
@@ -107660,7 +107968,7 @@ const mdxishTablesToJsx = () => tree => {
                             type: 'mdxJsxFlowElement',
                             name: 'th',
                             children: cell.children,
-                            ...(styles[cellIndex] && { attributes: [styles[cellIndex]] }),
+                            ...(headerStyles[cellIndex] && { attributes: [headerStyles[cellIndex]] }),
                         };
                     }),
                 },
@@ -107680,7 +107988,7 @@ const mdxishTablesToJsx = () => tree => {
                             type: 'mdxJsxFlowElement',
                             name: 'td',
                             children: cell.children,
-                            ...(styles[cellIndex] && { attributes: [styles[cellIndex]] }),
+                            ...(bodyStyles[cellIndex] && { attributes: [bodyStyles[cellIndex]] }),
                         };
                     }),
                 };
@@ -107964,6 +108272,8 @@ function loadComponents() {
 
 
 
+
+
 
 
 
@@ -108091,7 +108401,7 @@ function mdxishMdastToMd(mdast) {
  * @see .claude/context/MDXish/Processor Overview.md
  */
 function mdxish(mdContent, opts = {}) {
-    const { components: userComponents = {}, hardBreaks: enableHardBreaks = true, safeMode = false, variables } = opts;
+    const { components: userComponents = {}, hardBreaks: enableHardBreaks = true, safeMode = false, sanitize = false, variables, } = opts;
     const components = {
         ...loadComponents(),
         ...userComponents,
@@ -108102,7 +108412,7 @@ function mdxish(mdContent, opts = {}) {
     const contentWithoutComments = restoreCodeBlocks(withoutComments, protectedCode);
     const { processor, parserReadyContent } = mdxishAstProcessor(contentWithoutComments, opts);
     processor
-        .use(safeMode ? undefined : evaluate_exports) // Evaluate `export const/function` and stash scope on file.data.mdxishScope
+        .use(safeMode ? undefined : evaluate_exports, { sanitize }) // Evaluate `export const/function` and stash scope on file.data.mdxishScope
         .use(enableHardBreaks ? hard_breaks : undefined) // Must precede evaluateExpressions to avoid splitting the \n in an evaluated template literal into a <br> node
         .use(safeMode ? undefined : evaluate_expressions, { components, variables }) // Evaluate self-contained MDX expressions (e.g. `{1+1}`)
         .use(safeMode ? undefined : evaluate_style_block_expressions) // Evaluate `<style>{`...`}</style>` template literals into plain CSS
@@ -108113,13 +108423,15 @@ function mdxish(mdContent, opts = {}) {
         .use(restoreBooleanProperties)
         .use(safeMode ? undefined : resolve_deferred_attribute_expression_props) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
         .use(normalize_mdx_jsx_nodes) // Rewrite `mdx-jsx` back to standard `element` nodes for downstream plugins
+        .use(sanitize ? rehypeStripTags : undefined) // Strip STRIPPED_TAG_NAMES elements; this pipeline has no sanitization step
         .use(rehypeFlattenTableCellParagraphs) // Remove <p> wrappers inside table cells to prevent margin issues
         .use(mdxish_mermaid) // Add mermaid-render className to pre wrappers
         .use(heading_slugs)
         .use(rehypeMdxishComponents, {
         components,
         processMarkdown: (markdown) => mdxish(markdown, opts),
-    });
+    })
+        .use(safeMode ? enforceSafeModeHtmlBlocks : undefined); // Force safeMode on every HTMLBlock; runs last so every producer is covered
     const vfile = new VFile({ value: parserReadyContent });
     const mdast = processor.parse(parserReadyContent);
     const hast = processor.runSync(mdast, vfile);
@@ -109091,7 +109403,7 @@ module.exports = /*#__PURE__*/JSON.parse('{"*":["about","acceptCharset","accessK
 /******/ 	// startup
 /******/ 	// Load entry module and return exports
 /******/ 	// This entry module used 'module' so it can't be inlined
-/******/ 	let __webpack_exports__ = __webpack_require__(7070);
+/******/ 	let __webpack_exports__ = __webpack_require__(9171);
 /******/ 	
 /******/ 	return __webpack_exports__;
 /******/ })()