@readme/markdown 15.7.3 → 15.9.0

package/dist/processor/plugin/safe-mode-html-blocks.d.ts

@@ -0,0 +1,12 @@
+import type { Root } from 'hast';
+import type { Transformer } from 'unified';
+/**
+ * Forces `safeMode` on every element that renders through `HTMLBlock` so it is
+ * shown as escaped text instead of injected.
+ *
+ * Runs last, so it sees every producer of the element — `[block:html]`,
+ * `<HTMLBlock>` with a template body or an `html` attribute, and a literal
+ * `<html-block>` — and it is unconditional so an author-supplied
+ * `safeMode="false"` can't opt out.
+ */
+export declare const enforceSafeModeHtmlBlocks: () => Transformer<Root, Root>;

package/dist/processor/plugin/strip-tags.d.ts

@@ -0,0 +1,31 @@
+import type { Program } from 'estree';
+import type { Root } from 'hast';
+import type { Plugin, Transformer } from 'unified';
+/**
+ * Tags removed from user-provided content because rendering them executes in the
+ * page. Add an entry to cover another vector; nothing else needs to change.
+ *
+ * Deliberately narrow for now — `<script>` is the only vector this plugin claims
+ * to close. Broader parity with the `md` sanitization schema (`javascript:` URLs,
+ * `on*` handlers, `<iframe>`, `<object>`, …) is tracked in readmeio/markdown#1526.
+ */
+export declare const STRIPPED_TAG_NAMES: Set<string>;
+/**
+ * Removes matching elements and their subtrees when `sanitize` is enabled.
+ *
+ * Explicit `HTMLBlock`s are an intentional exception, matching legacy: their
+ * scripts live in a string prop rather than as elements, so they never appear
+ * in SSR HTML, and they only execute client-side when the author opts in via
+ * `runScripts`.
+ */
+export declare const rehypeStripTags: () => Transformer<Root, Root>;
+/**
+ * JSX inside expressions and exports stays in ESTree, outside the HAST pass.
+ * Strip it before evaluation in mdxish or after JSX compilation in MDX.
+ *
+ * Elements are spliced out of JSX children and replaced with `null` anywhere
+ * else, which React renders as nothing.
+ */
+export declare const stripJsxTags: (program: Program) => Program;
+/** `stripJsxTags` as a recma plugin, for the `mdx` compile pipeline. */
+export declare const recmaStripTags: Plugin<[], Program>;

package/dist/processor/transform/mdxish/evaluate-exports.d.ts

@@ -11,6 +11,10 @@ declare module 'hast' {
         mdxishScope?: MdxishScope;
     }
 }
+interface Options {
+    /** Drop `STRIPPED_TAG_NAMES` JSX from the exported code before it is evaluated. */
+    sanitize?: boolean;
+}
 /**
  * Evaluate `export const/function` declarations introduced by mdxjsEsm nodes.
  *
@@ -23,5 +27,5 @@ declare module 'hast' {
  * Any evaluation error is consumed and logged. We don't throw because it's
  * against the spirit of this engine to be less permissive than MDX needs.
  */
-declare const evaluateExports: Plugin<[], Root>;
+declare const evaluateExports: Plugin<[Options?], Root>;
 export default evaluateExports;

package/dist/processor/transform/mdxish/magic-blocks/types.d.ts

@@ -64,7 +64,6 @@ export interface RecipeJson extends MagicBlockJson {
 export interface MagicBlockTransformerOptions {
     compatibilityMode?: boolean;
     hardBreaks?: boolean;
-    safeMode?: boolean;
 }
 /**
  * Magic block image node structure (output from magicBlockTransformer).

package/dist/processor/transform/mdxish/tables/cell-style.d.ts

@@ -0,0 +1,7 @@
+import type { MdxJsxAttribute } from 'mdast-util-mdx-jsx';
+type CellAlign = 'center' | 'left' | 'right' | null;
+/** `left` is the browser default, so it's omitted. Lowercase tables get the HTML string form. */
+export declare const cellStyle: (align: CellAlign, width?: string | null, { html }?: {
+    html?: boolean;
+}) => MdxJsxAttribute | null;
+export {};

package/dist/processor/transform/mdxish/tables/cell-width.d.ts

@@ -0,0 +1,9 @@
+import type { MdxJsxFlowElement, MdxJsxTextElement } from 'mdast-util-mdx-jsx';
+/** Bare numbers are pixels. A value carrying declaration separators is not a single width. */
+export declare const normalizeWidth: (value: unknown) => string | null;
+/** Handles a CSS declaration list and a style object safe mode left as a string (`{ width: "30%" }`). */
+export declare const widthFromStyleString: (style: string) => string | undefined;
+/** Accepts `style={{ width }}`, `style="width: …"` and the hand-authored `width="…"`. */
+export declare const getCellWidth: (cell: MdxJsxFlowElement | MdxJsxTextElement) => string | null;
+/** True when the cell's attributes state nothing but its width, which mdast can carry. */
+export declare const hasOnlyWidthAttributes: (cell: MdxJsxFlowElement | MdxJsxTextElement) => boolean;