@readme/markdown 15.7.3 → 15.9.0

package/dist/render-fixture.node.js

@@ -19045,7 +19045,7 @@ module.exports = function () {
 
 /***/ },
 
-/***/ 5072
+/***/ 8900
 (module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -92178,9 +92178,9 @@ const HTMLBlock = ({ children = '', html: htmlProp, runScripts, safeMode: safeMo
     const safeMode = typeof safeModeRaw !== 'boolean' ? safeModeRaw === 'true' : safeModeRaw;
     const [cleanedHtml, exec] = extractScripts(html);
     (0,external_react_.useEffect)(() => {
-        if (typeof window !== 'undefined' && typeof runScripts === 'boolean' && runScripts)
+        if (typeof window !== 'undefined' && typeof runScripts === 'boolean' && runScripts && !safeMode)
             exec();
-    }, [runScripts, exec]);
+    }, [runScripts, safeMode, exec]);
     if (nonStringChildren) {
         // Fail soft: a non-string child (e.g. JSX that wasn't serialized back to a
         // raw string) should never throw, so render the child nodes directly
@@ -114138,6 +114138,133 @@ const hardBreaks = () => tree => {
 };
 /* harmony default export */ const hard_breaks = (hardBreaks);
 
+;// ./processor/plugin/strip-tags.ts
+
+/**
+ * Tags removed from user-provided content because rendering them executes in the
+ * page. Add an entry to cover another vector; nothing else needs to change.
+ *
+ * Deliberately narrow for now — `<script>` is the only vector this plugin claims
+ * to close. Broader parity with the `md` sanitization schema (`javascript:` URLs,
+ * `on*` handlers, `<iframe>`, `<object>`, …) is tracked in readmeio/markdown#1526.
+ */
+const STRIPPED_TAG_NAMES = new Set(['script']);
+/** JSX names starting with a capital are component references, not literal tags. */
+const LITERAL_TAG_NAME = /^[a-z]/;
+/**
+ * Whether a node would render as one of the stripped literal DOM elements.
+ * Browsers match tag names case-insensitively, so `<sCrIpT>` executes too.
+ *
+ * `<Script />` and friends are component references and are left alone.
+ */
+const isStrippedTag = (node) => {
+    if (node.type === 'element')
+        return STRIPPED_TAG_NAMES.has(node.tagName.toLowerCase());
+    if (node.type === 'mdxJsxFlowElement' || node.type === 'mdxJsxTextElement') {
+        const name = node.name ?? '';
+        return LITERAL_TAG_NAME.test(name) && STRIPPED_TAG_NAMES.has(name.toLowerCase());
+    }
+    return false;
+};
+/**
+ * Removes matching elements and their subtrees when `sanitize` is enabled.
+ *
+ * Explicit `HTMLBlock`s are an intentional exception, matching legacy: their
+ * scripts live in a string prop rather than as elements, so they never appear
+ * in SSR HTML, and they only execute client-side when the author opts in via
+ * `runScripts`.
+ */
+const rehypeStripTags = () => {
+    return (tree) => {
+        visit(tree, isStrippedTag, (_node, index, parent) => {
+            parent.children.splice(index, 1);
+            return [(/* inlined export .SKIP */"skip"), index];
+        });
+    };
+};
+/** The automatic-runtime factories MDX compiles JSX into. */
+const JSX_FACTORIES = new Set(['_jsx', '_jsxs', '_jsxDEV']);
+/**
+ * Matches raw JSX and compiled `_jsx('tag', …)` calls. MDX may rewrite literal
+ * tags as `_components.<tag>` so a `components` prop can override them.
+ */
+const isStrippedJsxElement = (node) => {
+    if (node.type === 'JSXElement') {
+        const { name } = node.openingElement;
+        if (name.type === 'JSXIdentifier') {
+            return LITERAL_TAG_NAME.test(name.name) && STRIPPED_TAG_NAMES.has(name.name.toLowerCase());
+        }
+        return (name.type === 'JSXMemberExpression' &&
+            name.object.type === 'JSXIdentifier' &&
+            name.object.name === '_components' &&
+            STRIPPED_TAG_NAMES.has(name.property.name.toLowerCase()));
+    }
+    if (node.type === 'CallExpression' && node.callee.type === 'Identifier' && JSX_FACTORIES.has(node.callee.name)) {
+        const [tag] = node.arguments;
+        if (!tag)
+            return false;
+        if (tag.type === 'Literal')
+            return typeof tag.value === 'string' && STRIPPED_TAG_NAMES.has(tag.value.toLowerCase());
+        return (tag.type === 'MemberExpression' &&
+            tag.object.type === 'Identifier' &&
+            tag.object.name === '_components' &&
+            tag.property.type === 'Identifier' &&
+            STRIPPED_TAG_NAMES.has(tag.property.name.toLowerCase()));
+    }
+    return false;
+};
+const isEstreeNode = (value) => typeof value === 'object' && value !== null && typeof value.type === 'string';
+const nullLiteral = () => ({ type: 'Literal', value: null });
+/**
+ * JSX inside expressions and exports stays in ESTree, outside the HAST pass.
+ * Strip it before evaluation in mdxish or after JSX compilation in MDX.
+ *
+ * Elements are spliced out of JSX children and replaced with `null` anywhere
+ * else, which React renders as nothing.
+ */
+const stripJsxTags = (program) => {
+    const walk = (node) => {
+        const record = node;
+        Object.keys(record).forEach(key => {
+            if (key === 'loc' || key === 'range' || key === 'position')
+                return;
+            const value = record[key];
+            if (Array.isArray(value)) {
+                for (let i = value.length - 1; i >= 0; i -= 1) {
+                    const child = value[i];
+                    if (isEstreeNode(child)) {
+                        if (isStrippedJsxElement(child)) {
+                            if (key === 'children')
+                                value.splice(i, 1);
+                            else
+                                value[i] = nullLiteral();
+                        }
+                        else {
+                            walk(child);
+                        }
+                    }
+                }
+                return;
+            }
+            if (!isEstreeNode(value))
+                return;
+            if (isStrippedJsxElement(value)) {
+                record[key] =
+                    node.type === 'JSXAttribute' ? { type: 'JSXExpressionContainer', expression: nullLiteral() } : nullLiteral();
+            }
+            else {
+                walk(value);
+            }
+        });
+    };
+    walk(program);
+    return program;
+};
+/** `stripJsxTags` as a recma plugin, for the `mdx` compile pipeline. */
+const recmaStripTags = () => tree => {
+    stripJsxTags(tree);
+};
+
 ;// ./node_modules/estree-util-value-to-estree/dist/estree-util-value-to-estree.js
 /**
  * Create an ESTree identifier node for a given name.
@@ -116875,6 +117002,7 @@ const tocHastToMdx = (toc, components, variables) => {
 
 
 
+
 const sanitizeSchema = cjs_default()(defaultSchema, {
     attributes: {
         a: ['target'],
@@ -116883,7 +117011,10 @@ const sanitizeSchema = cjs_default()(defaultSchema, {
         href: ['doc', 'ref', 'blog', 'changelog', 'page'],
     },
 });
-const compile_compile = (text, { components = {}, missingComponents, copyButtons, useTailwind, hardBreaks, ...opts } = {}) => {
+const compile_compile = (text, { components = {}, missingComponents, copyButtons, useTailwind, hardBreaks, sanitize = false, 
+// Pulled out of `...opts` so a caller's plugins extend the pipeline instead of
+// replacing it — otherwise the spread below would drop `rehypeStripTags`.
+remarkPlugins: userRemarkPlugins, rehypePlugins: userRehypePlugins, recmaPlugins: userRecmaPlugins, ...opts } = {}) => {
     // Destructure at runtime to avoid circular dependency issues
     const { codeTabsTransformer, ...transforms } = defaultTransforms;
     const remarkPlugins = [
@@ -116901,7 +117032,12 @@ const compile_compile = (text, { components = {}, missingComponents, copyButtons
     if (useTailwind) {
         remarkPlugins.push([transform_tailwind, { components }]);
     }
-    const rehypePlugins = [...ast_processor_rehypePlugins, [rehypeToc, { components }]];
+    remarkPlugins.push(...(userRemarkPlugins ?? []));
+    const rehypePlugins = [
+        ...ast_processor_rehypePlugins,
+        [rehypeToc, { components }],
+        ...(userRehypePlugins ?? []),
+    ];
     if (opts.format === 'md') {
         /**
          * When running in `md` format we need to sanitize the content for security reasons.
@@ -116919,12 +117055,23 @@ const compile_compile = (text, { components = {}, missingComponents, copyButtons
         ]);
         rehypePlugins.push([rehypeSanitize, sanitizeSchema]);
     }
+    const recmaPlugins = [...(userRecmaPlugins ?? [])];
+    // In `mdx` format a literal <script> parses as JSX rather than raw HTML, so it
+    // bypasses sanitization entirely — strip it in every format. Must stay last:
+    // in `md` format raw HTML isn't an element until `rehypeRaw` has run. A tag
+    // inside an expression or export is code, not an element, so the recma pass
+    // catches it in the compiled program instead.
+    if (sanitize) {
+        rehypePlugins.push(rehypeStripTags);
+        recmaPlugins.push(recmaStripTags);
+    }
     try {
         const vfile = compileSync(text, {
             outputFormat: 'function-body',
             providerImportSource: '#',
             remarkPlugins,
             rehypePlugins,
+            recmaPlugins,
             ...opts,
         });
         const string = String(vfile)
@@ -122278,6 +122425,32 @@ const mdxComponentHandlers = {
     [NodeTypes.htmlBlock]: htmlBlockHandler,
 };
 
+;// ./processor/plugin/safe-mode-html-blocks.ts
+
+
+/**
+ * Whether a tag name renders through the `HTMLBlock` component. Mirrors the
+ * separator-agnostic, case-insensitive lookup in `getComponentName` and the
+ * rehype-react component map, so `html-block`, `HTMLBlock`, `HtmlBlock` and
+ * `htmlblock` all match.
+ */
+const isHtmlBlockTag = (tagName) => toPascalCase(tagName).toLowerCase() === 'htmlblock';
+/**
+ * Forces `safeMode` on every element that renders through `HTMLBlock` so it is
+ * shown as escaped text instead of injected.
+ *
+ * Runs last, so it sees every producer of the element — `[block:html]`,
+ * `<HTMLBlock>` with a template body or an `html` attribute, and a literal
+ * `<html-block>` — and it is unconditional so an author-supplied
+ * `safeMode="false"` can't opt out.
+ */
+const enforceSafeModeHtmlBlocks = () => tree => {
+    visit(tree, 'element', node => {
+        if (isHtmlBlockTag(node.tagName))
+            node.properties.safeMode = 'true';
+    });
+};
+
 ;// ./processor/transform/mdxish/anchor-to-jsx.ts
 /* unused harmony import specifier */ var anchor_to_jsx_visit;
 /* unused harmony import specifier */ var anchor_to_jsx_NodeTypes;
@@ -123598,6 +123771,7 @@ const collectImportValues = (importDeclarations, registry = defaultModuleRegistr
 
 
 
+
 /**
  * Recursively extract all identifier names introduced by a binding pattern.
  * Handles destructuring (`{ a, b }`, `[x, y]`), rest elements (`...rest`),
@@ -123642,7 +123816,7 @@ const collectExportNames = (declaration) => {
  * Any evaluation error is consumed and logged. We don't throw because it's
  * against the spirit of this engine to be less permissive than MDX needs.
  */
-const evaluateExports = () => (tree, file) => {
+const evaluateExports = (opts) => (tree, file) => {
     const programBody = [];
     const exportNames = [];
     const importDeclarations = [];
@@ -123688,6 +123862,8 @@ const evaluateExports = () => (tree, file) => {
     // Evaluate the declarations together at once in a single sandboxed Function
     try {
         const program = { type: 'Program', sourceType: 'module', body: programBody };
+        if (opts?.sanitize)
+            stripJsxTags(program);
         buildJsx(program, { runtime: 'classic', pragma: 'React.createElement', pragmaFrag: 'React.Fragment' });
         const { value: source } = toJs(program);
         // Make sure import values are available in the scope
@@ -125997,7 +126173,7 @@ const parseApiHeaderTitle = (text) => {
  * Transform a magicBlock node into final MDAST nodes.
  */
 function transformMagicBlock(blockType, data, rawValue, options = {}) {
-    const { compatibilityMode = false, hardBreaks = true, safeMode = false } = options;
+    const { compatibilityMode = false, hardBreaks = true } = options;
     // Handle empty data by returning placeholder nodes for known block types
     // This allows the editor to show appropriate placeholder UI instead of nothing
     if (Object.keys(data).length < 1) {
@@ -126215,7 +126391,7 @@ function transformMagicBlock(blockType, data, rawValue, options = {}) {
                 wrapPinnedBlocks({
                     data: {
                         hName: 'html-block',
-                        hProperties: { html: htmlJson.html, runScripts: compatibilityMode, safeMode },
+                        hProperties: { html: htmlJson.html, runScripts: compatibilityMode },
                     },
                     type: 'html-block',
                 }, data),
@@ -126475,6 +126651,80 @@ const mdxishHtmlBlocks = () => tree => {
 };
 /* harmony default export */ const mdxish_html_blocks = (mdxishHtmlBlocks);
 
+;// ./processor/transform/mdxish/tables/cell-width.ts
+
+
+// Key must follow `{` or `,` so `minWidth`/`maxWidth` don't match on their suffix
+const STYLE_OBJECT_WIDTH_REGEX = /[{,]\s*["']?width["']?\s*:\s*(?:"([^"]*)"|'([^']*)'|([^,}]+))/i;
+// First colon only, so `url(http://…)` values stay intact
+const CSS_DECLARATION_REGEX = /:(.*)/s;
+const UNITLESS_NUMBER_REGEX = /^\d+(?:\.\d+)?$/;
+// HTML reads a `width` attribute as a leading number plus optional `%`, ignoring the rest
+const HTML_DIMENSION_REGEX = /^\s*(\d+(?:\.\d+)?)\s*(%?)/;
+/** Bare numbers are pixels. A value carrying declaration separators is not a single width. */
+const normalizeWidth = (value) => {
+    if (typeof value === 'number')
+        return `${value}px`;
+    if (typeof value !== 'string' || !value.trim())
+        return null;
+    const trimmed = value.trim();
+    if (/[;:{}]/.test(trimmed))
+        return null;
+    return UNITLESS_NUMBER_REGEX.test(trimmed) ? `${trimmed}px` : trimmed;
+};
+const widthFromAttribute = (value) => {
+    if (typeof value === 'number')
+        return `${value}px`;
+    if (typeof value !== 'string')
+        return null;
+    const match = HTML_DIMENSION_REGEX.exec(value);
+    return match ? `${match[1]}${match[2] || 'px'}` : null;
+};
+const cssPropertyNames = (style) => style
+    .split(';')
+    .map(declaration => declaration.split(CSS_DECLARATION_REGEX)[0].trim().toLowerCase())
+    .filter(Boolean);
+/** Handles a CSS declaration list and a style object safe mode left as a string (`{ width: "30%" }`). */
+const widthFromStyleString = (style) => {
+    const trimmed = style.trim();
+    if (trimmed.startsWith('{')) {
+        return STYLE_OBJECT_WIDTH_REGEX.exec(trimmed)?.slice(1).find(Boolean);
+    }
+    return trimmed
+        .split(';')
+        .map(declaration => declaration.split(CSS_DECLARATION_REGEX))
+        .find(([property]) => property.trim().toLowerCase() === 'width')?.[1];
+};
+/** Accepts `style={{ width }}`, `style="width: …"` and the hand-authored `width="…"`. */
+const getCellWidth = (cell) => {
+    const { style, width } = getAttrs(cell);
+    let styleWidth;
+    if (style_object_to_css_isPlainObject(style)) {
+        styleWidth = style.width;
+    }
+    else if (typeof style === 'string') {
+        styleWidth = widthFromStyleString(style);
+    }
+    return normalizeWidth(styleWidth) ?? widthFromAttribute(width);
+};
+/** True when the cell's attributes state nothing but its width, which mdast can carry. */
+const hasOnlyWidthAttributes = (cell) => {
+    if (cell.attributes.length === 0)
+        return false;
+    const { style } = getAttrs(cell);
+    return cell.attributes.every(attribute => {
+        if (!('name' in attribute))
+            return false;
+        if (attribute.name === 'width')
+            return true;
+        if (attribute.name !== 'style')
+            return false;
+        if (style_object_to_css_isPlainObject(style))
+            return Object.keys(style).every(key => key === 'width');
+        return typeof style === 'string' && cssPropertyNames(style).every(property => property === 'width');
+    });
+};
+
 ;// ./processor/transform/mdxish/mdxish-jsx-to-mdast.ts
 
 
@@ -126482,6 +126732,7 @@ const mdxishHtmlBlocks = () => tree => {
 
 
 
+
 function toImageAlign(value) {
     if (value === 'left' || value === 'center' || value === 'right') {
         return value;
@@ -126923,10 +127174,40 @@ const wrapBareCellsInRow = (node) => {
     });
 };
 /**
- * Converts a JSX <Table> element to an MDAST table node with alignment.
- * Returns null for header-less tables since MDAST always promotes the first row to <thead>.
+ * A lowercase <table> reaches here only because `mdxishTables` kept it as JSX for its
+ * attributes. Widths on first-row cells are the one attribute mdast can carry; anything
+ * else stays JSX so it still renders.
+ */
+const lowercaseTableIsConvertible = (jsx) => {
+    if (jsx.attributes.length > 0)
+        return false;
+    const headerCells = new Set();
+    let headerRowSeen = false;
+    let convertible = true;
+    visit(jsx, isMDXElement, (child) => {
+        if (child.name === 'tr' && !headerRowSeen) {
+            headerRowSeen = true;
+            visit(child, mdxish_jsx_to_mdast_isTableCell, cell => {
+                headerCells.add(cell);
+            });
+        }
+        if (child.name === null || !tableTags.has(child.name) || child.attributes.length === 0)
+            return;
+        if (!headerCells.has(child) || !hasOnlyWidthAttributes(child) || getCellWidth(child) === null) {
+            convertible = false;
+        }
+    });
+    return convertible;
+};
+/**
+ * Converts a JSX <Table>, or a lowercase <table> carrying only widths, to an MDAST table
+ * node with alignment and widths. Returns null for header-less tables since MDAST always
+ * promotes the first row to <thead>.
  */
 const transformTable = (jsx) => {
+    const isLowercase = jsx.name === 'table';
+    if (isLowercase && !lowercaseTableIsConvertible(jsx))
+        return null;
     wrapBareCellsInRow(jsx);
     let hasThead = false;
     visit(jsx, isMDXElement, (child) => {
@@ -126938,6 +127219,7 @@ const transformTable = (jsx) => {
     const { align: alignAttr } = getAttrs(jsx);
     const align = Array.isArray(alignAttr) ? alignAttr : null;
     const rows = [];
+    const widths = [];
     visit(jsx, isMDXElement, (child) => {
         if (child.name !== 'thead' && child.name !== 'tbody')
             return;
@@ -126945,6 +127227,7 @@ const transformTable = (jsx) => {
             if (row.name !== 'tr')
                 return;
             const cells = [];
+            const isHeaderRow = rows.length === 0;
             visit(row, mdxish_jsx_to_mdast_isTableCell, (cell) => {
                 const parsedChildren = unwrapSoleParagraph(cell.children);
                 cells.push({
@@ -126952,6 +127235,8 @@ const transformTable = (jsx) => {
                     children: parsedChildren,
                     position: cell.position,
                 });
+                if (isHeaderRow)
+                    widths.push(getCellWidth(cell));
             });
             rows.push({
                 type: 'tableRow',
@@ -126964,11 +127249,16 @@ const transformTable = (jsx) => {
     const alignArray = align && columnCount > 0
         ? align.slice(0, columnCount).concat(Array.from({ length: Math.max(0, columnCount - align.length) }, () => null))
         : Array.from({ length: columnCount }, () => null);
+    const data = {
+        ...(isLowercase && { lowercaseTable: true }),
+        ...(widths.some(Boolean) && { widths }),
+    };
     return {
         type: 'table',
         align: alignArray,
         position: jsx.position,
         children: rows,
+        ...(Object.keys(data).length > 0 && { data }),
     };
 };
 /**
@@ -126998,6 +127288,7 @@ const COMPONENT_MAP = {
     figure: transformFigure,
     Recipe: transformRecipe,
     Table: transformTable,
+    table: transformTable,
 };
 /**
  * Transform mdxJsxFlowElement nodes, magic block nodes, and HTML figure elements
@@ -127477,25 +127768,15 @@ const restoreBooleanProperties = () => tree => {
 /* unused harmony import specifier */ var mdxish_tables_to_jsx_phrasing;
 /* unused harmony import specifier */ var mdxish_tables_to_jsx_visit;
 /* unused harmony import specifier */ var mdxish_tables_to_jsx_NodeTypes;
+/* unused harmony import specifier */ var cellStyle;
 /* unused harmony import specifier */ var hasChildren;
 /* unused harmony import specifier */ var normalizeCellChildrenForGfm;
 
 
 
 
+
 const SELF_CLOSING_JSX_REGEX = /^\s*<[A-Z][^>]*\/>\s*$/;
-const mdxish_tables_to_jsx_alignToStyle = (align) => {
-    if (!align || align === 'left')
-        return null;
-    return {
-        type: 'mdxJsxAttribute',
-        name: 'style',
-        value: {
-            type: 'mdxJsxAttributeValueExpression',
-            value: `{ textAlign: "${align}" }`,
-        },
-    };
-};
 const mdxish_tables_to_jsx_isTableCell = (node) => ['tableHead', 'tableCell'].includes(node.type);
 const mdxish_tables_to_jsx_isLiteral = (node) => 'value' in node;
 /**
@@ -127551,12 +127832,17 @@ const mdxishTablesToJsx = () => tree => {
             gfmCells.push([cell, normalized]);
             return undefined;
         });
-        const stayLowercase = table.data?.lowercaseTable === true;
+        const widths = table.data?.widths ?? [];
+        const hasWidths = widths.some(Boolean);
+        // Lowercase cells can carry a width but not an alignment, so an aligned table becomes <Table>
+        const hasAlignment = table.align.some(align => align && align !== 'left');
+        const stayLowercase = table.data?.lowercaseTable === true && !hasAlignment;
         // We transform to GFM tables if:
         // 1. If it doesn't contain complex elements that the syntax can't represent
-        // 2. The original table is not lowercase HTML <table>, because we want to 
+        // 2. The original table is not lowercase HTML <table>, because we want to
         // preserve original tables as much as possible
-        if (!requiresJsxTable && !stayLowercase) {
+        // 3. No column has a width, which GFM can't express
+        if (!requiresJsxTable && !stayLowercase && !hasWidths) {
             gfmCells.forEach(([cell, children]) => {
                 cell.children = children;
             });
@@ -127568,7 +127854,8 @@ const mdxishTablesToJsx = () => tree => {
         if (!headerRow)
             return;
         mdxish_tables_to_jsx_visit(table, mdxish_tables_to_jsx_isTableCell, flattenBreaksToNewlines);
-        const styles = table.align.map(mdxish_tables_to_jsx_alignToStyle);
+        const headerStyles = table.align.map((align, i) => cellStyle(align, widths[i] ?? null, { html: stayLowercase }));
+        const bodyStyles = table.align.map(align => cellStyle(align, null, { html: stayLowercase }));
         const head = {
             attributes: [],
             type: 'mdxJsxFlowElement',
@@ -127584,7 +127871,7 @@ const mdxishTablesToJsx = () => tree => {
                             type: 'mdxJsxFlowElement',
                             name: 'th',
                             children: cell.children,
-                            ...(styles[cellIndex] && { attributes: [styles[cellIndex]] }),
+                            ...(headerStyles[cellIndex] && { attributes: [headerStyles[cellIndex]] }),
                         };
                     }),
                 },
@@ -127604,7 +127891,7 @@ const mdxishTablesToJsx = () => tree => {
                             type: 'mdxJsxFlowElement',
                             name: 'td',
                             children: cell.children,
-                            ...(styles[cellIndex] && { attributes: [styles[cellIndex]] }),
+                            ...(bodyStyles[cellIndex] && { attributes: [bodyStyles[cellIndex]] }),
                         };
                     }),
                 };
@@ -127883,6 +128170,8 @@ function loadComponents() {
 
 
 
+
+
 
 
 
@@ -128010,7 +128299,7 @@ function mdxishMdastToMd(mdast) {
  * @see .claude/context/MDXish/Processor Overview.md
  */
 function mdxish(mdContent, opts = {}) {
-    const { components: userComponents = {}, hardBreaks: enableHardBreaks = true, safeMode = false, variables } = opts;
+    const { components: userComponents = {}, hardBreaks: enableHardBreaks = true, safeMode = false, sanitize = false, variables, } = opts;
     const components = {
         ...loadComponents(),
         ...userComponents,
@@ -128021,7 +128310,7 @@ function mdxish(mdContent, opts = {}) {
     const contentWithoutComments = restoreCodeBlocks(withoutComments, protectedCode);
     const { processor, parserReadyContent } = mdxishAstProcessor(contentWithoutComments, opts);
     processor
-        .use(safeMode ? undefined : evaluate_exports) // Evaluate `export const/function` and stash scope on file.data.mdxishScope
+        .use(safeMode ? undefined : evaluate_exports, { sanitize }) // Evaluate `export const/function` and stash scope on file.data.mdxishScope
         .use(enableHardBreaks ? hard_breaks : undefined) // Must precede evaluateExpressions to avoid splitting the \n in an evaluated template literal into a <br> node
         .use(safeMode ? undefined : evaluate_expressions, { components, variables }) // Evaluate self-contained MDX expressions (e.g. `{1+1}`)
         .use(safeMode ? undefined : evaluate_style_block_expressions) // Evaluate `<style>{`...`}</style>` template literals into plain CSS
@@ -128032,13 +128321,15 @@ function mdxish(mdContent, opts = {}) {
         .use(restoreBooleanProperties)
         .use(safeMode ? undefined : resolve_deferred_attribute_expression_props) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
         .use(normalize_mdx_jsx_nodes) // Rewrite `mdx-jsx` back to standard `element` nodes for downstream plugins
+        .use(sanitize ? rehypeStripTags : undefined) // Strip STRIPPED_TAG_NAMES elements; this pipeline has no sanitization step
         .use(rehypeFlattenTableCellParagraphs) // Remove <p> wrappers inside table cells to prevent margin issues
         .use(mdxish_mermaid) // Add mermaid-render className to pre wrappers
         .use(heading_slugs)
         .use(rehypeMdxishComponents, {
         components,
         processMarkdown: (markdown) => mdxish(markdown, opts),
-    });
+    })
+        .use(safeMode ? enforceSafeModeHtmlBlocks : undefined); // Force safeMode on every HTMLBlock; runs last so every producer is covered
     const vfile = new VFile({ value: parserReadyContent });
     const mdast = processor.parse(parserReadyContent);
     const hast = processor.runSync(mdast, vfile);
@@ -129114,7 +129405,7 @@ module.exports = /*#__PURE__*/JSON.parse('{"*":["about","acceptCharset","accessK
 /******/ 	// startup
 /******/ 	// Load entry module and return exports
 /******/ 	// This entry module used 'module' so it can't be inlined
-/******/ 	let __webpack_exports__ = __webpack_require__(5072);
+/******/ 	let __webpack_exports__ = __webpack_require__(8900);
 /******/ 	module.exports = __webpack_exports__;
 /******/ 	
 /******/ })()