@reckona/mreact-shared 0.0.160 → 0.0.162

package/dist/compiler-contract.d.ts

@@ -1,17 +1,22 @@
+/** Version number for the compiler output metadata contract consumed by runtime packages. */
 export declare const compilerOutputContractVersion = 1;
+/** Server rendering mode requested for transformed component output. */
 export type ServerOutputMode = "string" | "stream";
+/** Receives HTML chunks and deferred work while server rendering. */
 export interface HtmlSink {
     append(chunk: string): void;
     backpressure?(): Promise<void>;
     defer?(task: PromiseLike<void>): void;
     signal?: AbortSignal;
 }
+/** Complete source transform result emitted by a compiler frontend. */
 export interface TransformOutput {
     code: string;
     map?: string | null;
     diagnostics: Diagnostic[];
     metadata: ModuleMetadata;
 }
+/** Compiler diagnostic reported for a transformed source module. */
 export interface Diagnostic {
     level: "info" | "warn" | "error";
     code: string;
@@ -19,15 +24,18 @@ export interface Diagnostic {
     loc?: SourceLocation;
     suggestion?: DiagnosticSuggestion;
 }
+/** Suggested action or reference attached to a compiler diagnostic. */
 export interface DiagnosticSuggestion {
     title: string;
     replacement?: string;
     link?: string;
 }
+/** One-based source location used by compiler diagnostics. */
 export interface SourceLocation {
     line: number;
     column: number;
 }
+/** Metadata that describes the transformed module and its runtime dependencies. */
 export interface ModuleMetadata {
     filename: string;
     target: CompileTarget;
@@ -46,30 +54,39 @@ export interface ModuleMetadata {
     serverReferences?: string[];
     eventHydrationManifest?: EventHydrationManifestMetadata;
 }
+/** Compilation target used to select client or server output. */
 export type CompileTarget = "client" | "server";
+/** Bootstrap script mode requested by server output metadata. */
 export type ServerBootstrapMode = "none" | "out-of-order-reorder";
+/** Compiler frontend implementation that produced a transform result. */
 export type CompilerFrontend = "oxc";
+/** Compiler implementation metadata stored with a transform result. */
 export interface CompilerMetadata {
     frontend: CompilerFrontend;
     typescriptFallback: boolean;
 }
+/** Client component export recorded for React Flight manifests. */
 export interface ClientReferenceMetadata {
     name: string;
     moduleId: string;
     exportName: string;
 }
+/** Component export discovered by the compiler for runtime registration. */
 export interface ComponentMetadata {
     name: string;
     exportName: string;
 }
+/** Runtime import required by transformed source output. */
 export interface RuntimeImport {
     source: string;
     specifiers: string[];
 }
+/** Event hydration manifest metadata emitted with transformed server output. */
 export interface EventHydrationManifestMetadata {
     version: 1;
     events: EventHydrationEntryMetadata[];
 }
+/** Event handler hydration entry recorded by the compiler. */
 export interface EventHydrationEntryMetadata {
     id: string;
     event: string;

package/dist/compiler-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compiler-contract.d.ts","sourceRoot":"","sources":["../src/compiler-contract.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEnD,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACpD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;CACzD;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAChD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,sBAAsB,CAAC;AAClE,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAErC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,2BAA2B,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"compiler-contract.d.ts","sourceRoot":"","sources":["../src/compiler-contract.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEnD,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACpD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;CACzD;AAED,iEAAiE;AACjE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAChD,iEAAiE;AACjE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,sBAAsB,CAAC;AAClE,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAErC,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,gFAAgF;AAChF,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,2BAA2B,EAAE,CAAC;CACvC;AAED,8DAA8D;AAC9D,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/dist/compiler-contract.js

@@ -1,2 +1,3 @@
+/** Version number for the compiler output metadata contract consumed by runtime packages. */
 export const compilerOutputContractVersion = 1;
 //# sourceMappingURL=compiler-contract.js.map

package/dist/compiler-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"compiler-contract.js","sourceRoot":"","sources":["../src/compiler-contract.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC","sourcesContent":["export const compilerOutputContractVersion = 1;\n\nexport type ServerOutputMode = \"string\" | \"stream\";\n\nexport interface HtmlSink {\n  append(chunk: string): void;\n  backpressure?(): Promise<void>;\n  defer?(task: PromiseLike<void>): void;\n  signal?: AbortSignal;\n}\n\nexport interface TransformOutput {\n  code: string;\n  map?: string | null;\n  diagnostics: Diagnostic[];\n  metadata: ModuleMetadata;\n}\n\nexport interface Diagnostic {\n  level: \"info\" | \"warn\" | \"error\";\n  code: string;\n  message: string;\n  loc?: SourceLocation;\n  suggestion?: DiagnosticSuggestion;\n}\n\nexport interface DiagnosticSuggestion {\n  title: string;\n  replacement?: string;\n  link?: string;\n}\n\nexport interface SourceLocation {\n  line: number;\n  column: number;\n}\n\nexport interface ModuleMetadata {\n  filename: string;\n  target: CompileTarget;\n  compiler: CompilerMetadata;\n  serverOutput?: ServerOutputMode;\n  serverBootstrap?: ServerBootstrapMode;\n  serverBootstrapNonce?: string;\n  serverBootstrapSrc?: string;\n  serverHydration?: boolean;\n  serverAwaitHydration?: boolean;\n  reactSuspenseRevealScriptSrc?: string;\n  components: ComponentMetadata[];\n  imports: RuntimeImport[];\n  clientReferences?: string[];\n  clientReferenceManifest?: ClientReferenceMetadata[];\n  serverReferences?: string[];\n  eventHydrationManifest?: EventHydrationManifestMetadata;\n}\n\nexport type CompileTarget = \"client\" | \"server\";\nexport type ServerBootstrapMode = \"none\" | \"out-of-order-reorder\";\nexport type CompilerFrontend = \"oxc\";\n\nexport interface CompilerMetadata {\n  frontend: CompilerFrontend;\n  typescriptFallback: boolean;\n}\n\nexport interface ClientReferenceMetadata {\n  name: string;\n  moduleId: string;\n  exportName: string;\n}\n\nexport interface ComponentMetadata {\n  name: string;\n  exportName: string;\n}\n\nexport interface RuntimeImport {\n  source: string;\n  specifiers: string[];\n}\n\nexport interface EventHydrationManifestMetadata {\n  version: 1;\n  events: EventHydrationEntryMetadata[];\n}\n\nexport interface EventHydrationEntryMetadata {\n  id: string;\n  event: string;\n  handler: string;\n}\n"]}
+{"version":3,"file":"compiler-contract.js","sourceRoot":"","sources":["../src/compiler-contract.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC","sourcesContent":["/** Version number for the compiler output metadata contract consumed by runtime packages. */\nexport const compilerOutputContractVersion = 1;\n\n/** Server rendering mode requested for transformed component output. */\nexport type ServerOutputMode = \"string\" | \"stream\";\n\n/** Receives HTML chunks and deferred work while server rendering. */\nexport interface HtmlSink {\n  append(chunk: string): void;\n  backpressure?(): Promise<void>;\n  defer?(task: PromiseLike<void>): void;\n  signal?: AbortSignal;\n}\n\n/** Complete source transform result emitted by a compiler frontend. */\nexport interface TransformOutput {\n  code: string;\n  map?: string | null;\n  diagnostics: Diagnostic[];\n  metadata: ModuleMetadata;\n}\n\n/** Compiler diagnostic reported for a transformed source module. */\nexport interface Diagnostic {\n  level: \"info\" | \"warn\" | \"error\";\n  code: string;\n  message: string;\n  loc?: SourceLocation;\n  suggestion?: DiagnosticSuggestion;\n}\n\n/** Suggested action or reference attached to a compiler diagnostic. */\nexport interface DiagnosticSuggestion {\n  title: string;\n  replacement?: string;\n  link?: string;\n}\n\n/** One-based source location used by compiler diagnostics. */\nexport interface SourceLocation {\n  line: number;\n  column: number;\n}\n\n/** Metadata that describes the transformed module and its runtime dependencies. */\nexport interface ModuleMetadata {\n  filename: string;\n  target: CompileTarget;\n  compiler: CompilerMetadata;\n  serverOutput?: ServerOutputMode;\n  serverBootstrap?: ServerBootstrapMode;\n  serverBootstrapNonce?: string;\n  serverBootstrapSrc?: string;\n  serverHydration?: boolean;\n  serverAwaitHydration?: boolean;\n  reactSuspenseRevealScriptSrc?: string;\n  components: ComponentMetadata[];\n  imports: RuntimeImport[];\n  clientReferences?: string[];\n  clientReferenceManifest?: ClientReferenceMetadata[];\n  serverReferences?: string[];\n  eventHydrationManifest?: EventHydrationManifestMetadata;\n}\n\n/** Compilation target used to select client or server output. */\nexport type CompileTarget = \"client\" | \"server\";\n/** Bootstrap script mode requested by server output metadata. */\nexport type ServerBootstrapMode = \"none\" | \"out-of-order-reorder\";\n/** Compiler frontend implementation that produced a transform result. */\nexport type CompilerFrontend = \"oxc\";\n\n/** Compiler implementation metadata stored with a transform result. */\nexport interface CompilerMetadata {\n  frontend: CompilerFrontend;\n  typescriptFallback: boolean;\n}\n\n/** Client component export recorded for React Flight manifests. */\nexport interface ClientReferenceMetadata {\n  name: string;\n  moduleId: string;\n  exportName: string;\n}\n\n/** Component export discovered by the compiler for runtime registration. */\nexport interface ComponentMetadata {\n  name: string;\n  exportName: string;\n}\n\n/** Runtime import required by transformed source output. */\nexport interface RuntimeImport {\n  source: string;\n  specifiers: string[];\n}\n\n/** Event hydration manifest metadata emitted with transformed server output. */\nexport interface EventHydrationManifestMetadata {\n  version: 1;\n  events: EventHydrationEntryMetadata[];\n}\n\n/** Event handler hydration entry recorded by the compiler. */\nexport interface EventHydrationEntryMetadata {\n  id: string;\n  event: string;\n  handler: string;\n}\n"]}

package/dist/html-elements.d.ts

@@ -1,2 +1,3 @@
+/** Returns true when an HTML tag is a void element that cannot have children. */
 export declare function isVoidHtmlElement(tagName: string): boolean;
 //# sourceMappingURL=html-elements.d.ts.map

package/dist/html-elements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html-elements.d.ts","sourceRoot":"","sources":["../src/html-elements.ts"],"names":[],"mappings":"AAiBA,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D"}
+{"version":3,"file":"html-elements.d.ts","sourceRoot":"","sources":["../src/html-elements.ts"],"names":[],"mappings":"AAiBA,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D"}

package/dist/html-elements.js

@@ -14,6 +14,7 @@ const voidHtmlElementNames = new Set([
     "track",
     "wbr",
 ]);
+/** Returns true when an HTML tag is a void element that cannot have children. */
 export function isVoidHtmlElement(tagName) {
     return voidHtmlElementNames.has(tagName);
 }

package/dist/html-elements.js.map

@@ -1 +1 @@
-{"version":3,"file":"html-elements.js","sourceRoot":"","sources":["../src/html-elements.ts"],"names":[],"mappings":"AAAA,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IACL,OAAO;IACP,IAAI;IACJ,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["const voidHtmlElementNames = new Set([\n  \"area\",\n  \"base\",\n  \"br\",\n  \"col\",\n  \"embed\",\n  \"hr\",\n  \"img\",\n  \"input\",\n  \"link\",\n  \"meta\",\n  \"param\",\n  \"source\",\n  \"track\",\n  \"wbr\",\n]);\n\nexport function isVoidHtmlElement(tagName: string): boolean {\n  return voidHtmlElementNames.has(tagName);\n}\n"]}
+{"version":3,"file":"html-elements.js","sourceRoot":"","sources":["../src/html-elements.ts"],"names":[],"mappings":"AAAA,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IACL,OAAO;IACP,IAAI;IACJ,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["const voidHtmlElementNames = new Set([\n  \"area\",\n  \"base\",\n  \"br\",\n  \"col\",\n  \"embed\",\n  \"hr\",\n  \"img\",\n  \"input\",\n  \"link\",\n  \"meta\",\n  \"param\",\n  \"source\",\n  \"track\",\n  \"wbr\",\n]);\n\n/** Returns true when an HTML tag is a void element that cannot have children. */\nexport function isVoidHtmlElement(tagName: string): boolean {\n  return voidHtmlElementNames.has(tagName);\n}\n"]}

package/dist/html-escape.d.ts

@@ -1,4 +1,7 @@
+/** Escapes text content for safe insertion between HTML tags. */
 export declare function escapeHtmlText(value: unknown): string;
+/** Escapes a value for safe use in an HTML attribute. */
 export declare function escapeHtmlAttribute(value: unknown): string;
+/** Escapes a value for safe use inside an already quoted HTML attribute. */
 export declare function escapeHtmlQuotedAttribute(value: unknown): string;
 //# sourceMappingURL=html-escape.d.ts.map

package/dist/html-escape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html-escape.d.ts","sourceRoot":"","sources":["../src/html-escape.ts"],"names":[],"mappings":"AAIA,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAErD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE1D;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhE"}
+{"version":3,"file":"html-escape.d.ts","sourceRoot":"","sources":["../src/html-escape.ts"],"names":[],"mappings":"AAIA,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAErD;AAED,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE1D;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhE"}

package/dist/html-escape.js

@@ -1,12 +1,15 @@
 const textEscapePattern = /[&<>]/;
 const attributeEscapePattern = /["&'<>]/;
 const quotedAttributeEscapePattern = /["&]/;
+/** Escapes text content for safe insertion between HTML tags. */
 export function escapeHtmlText(value) {
     return escapeHtml(String(value), textEscapePattern, textReplacement);
 }
+/** Escapes a value for safe use in an HTML attribute. */
 export function escapeHtmlAttribute(value) {
     return escapeHtml(String(value), attributeEscapePattern, attributeReplacement);
 }
+/** Escapes a value for safe use inside an already quoted HTML attribute. */
 export function escapeHtmlQuotedAttribute(value) {
     return escapeHtml(String(value), quotedAttributeEscapePattern, quotedAttributeReplacement);
 }

package/dist/html-escape.js.map

@@ -1 +1 @@
-{"version":3,"file":"html-escape.js","sourceRoot":"","sources":["../src/html-escape.ts"],"names":[],"mappings":"AAAA,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AACzC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,4BAA4B,EAAE,0BAA0B,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,OAAe,EACf,kBAAwD;IAExD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAExB,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAEhE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,IAAI,WAAW,CAAC;QACvB,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,EAAE;YACL,OAAO,OAAO,CAAC;QACjB,KAAK,EAAE;YACL,OAAO,MAAM,CAAC;QAChB,KAAK,EAAE;YACL,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,EAAE;YACL,OAAO,QAAQ,CAAC;QAClB,KAAK,EAAE;YACL,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["const textEscapePattern = /[&<>]/;\nconst attributeEscapePattern = /[\"&'<>]/;\nconst quotedAttributeEscapePattern = /[\"&]/;\n\nexport function escapeHtmlText(value: unknown): string {\n  return escapeHtml(String(value), textEscapePattern, textReplacement);\n}\n\nexport function escapeHtmlAttribute(value: unknown): string {\n  return escapeHtml(String(value), attributeEscapePattern, attributeReplacement);\n}\n\nexport function escapeHtmlQuotedAttribute(value: unknown): string {\n  return escapeHtml(String(value), quotedAttributeEscapePattern, quotedAttributeReplacement);\n}\n\nfunction escapeHtml(\n  value: string,\n  pattern: RegExp,\n  replacementForCode: (code: number) => string | undefined,\n): string {\n  const match = pattern.exec(value);\n\n  if (match === null) {\n    return value;\n  }\n\n  let escaped = \"\";\n  let lastIndex = 0;\n  let index = match.index;\n\n  for (; index < value.length; index += 1) {\n    const replacement = replacementForCode(value.charCodeAt(index));\n\n    if (replacement === undefined) {\n      continue;\n    }\n\n    if (lastIndex !== index) {\n      escaped += value.substring(lastIndex, index);\n    }\n\n    escaped += replacement;\n    lastIndex = index + 1;\n  }\n\n  return lastIndex === index ? escaped : escaped + value.substring(lastIndex, index);\n}\n\nfunction textReplacement(code: number): string | undefined {\n  switch (code) {\n    case 38:\n      return \"&amp;\";\n    case 60:\n      return \"&lt;\";\n    case 62:\n      return \"&gt;\";\n    default:\n      return undefined;\n  }\n}\n\nfunction attributeReplacement(code: number): string | undefined {\n  if (code === 34) {\n    return \"&quot;\";\n  }\n\n  if (code === 39) {\n    return \"&#39;\";\n  }\n\n  return textReplacement(code);\n}\n\nfunction quotedAttributeReplacement(code: number): string | undefined {\n  switch (code) {\n    case 34:\n      return \"&quot;\";\n    case 38:\n      return \"&amp;\";\n    default:\n      return undefined;\n  }\n}\n"]}
+{"version":3,"file":"html-escape.js","sourceRoot":"","sources":["../src/html-escape.ts"],"names":[],"mappings":"AAAA,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AACzC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;AACvE,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;AACjF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,4BAA4B,EAAE,0BAA0B,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,OAAe,EACf,kBAAwD;IAExD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAElC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAExB,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAEhE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,IAAI,WAAW,CAAC;QACvB,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,EAAE;YACL,OAAO,OAAO,CAAC;QACjB,KAAK,EAAE;YACL,OAAO,MAAM,CAAC;QAChB,KAAK,EAAE;YACL,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,EAAE;YACL,OAAO,QAAQ,CAAC;QAClB,KAAK,EAAE;YACL,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC","sourcesContent":["const textEscapePattern = /[&<>]/;\nconst attributeEscapePattern = /[\"&'<>]/;\nconst quotedAttributeEscapePattern = /[\"&]/;\n\n/** Escapes text content for safe insertion between HTML tags. */\nexport function escapeHtmlText(value: unknown): string {\n  return escapeHtml(String(value), textEscapePattern, textReplacement);\n}\n\n/** Escapes a value for safe use in an HTML attribute. */\nexport function escapeHtmlAttribute(value: unknown): string {\n  return escapeHtml(String(value), attributeEscapePattern, attributeReplacement);\n}\n\n/** Escapes a value for safe use inside an already quoted HTML attribute. */\nexport function escapeHtmlQuotedAttribute(value: unknown): string {\n  return escapeHtml(String(value), quotedAttributeEscapePattern, quotedAttributeReplacement);\n}\n\nfunction escapeHtml(\n  value: string,\n  pattern: RegExp,\n  replacementForCode: (code: number) => string | undefined,\n): string {\n  const match = pattern.exec(value);\n\n  if (match === null) {\n    return value;\n  }\n\n  let escaped = \"\";\n  let lastIndex = 0;\n  let index = match.index;\n\n  for (; index < value.length; index += 1) {\n    const replacement = replacementForCode(value.charCodeAt(index));\n\n    if (replacement === undefined) {\n      continue;\n    }\n\n    if (lastIndex !== index) {\n      escaped += value.substring(lastIndex, index);\n    }\n\n    escaped += replacement;\n    lastIndex = index + 1;\n  }\n\n  return lastIndex === index ? escaped : escaped + value.substring(lastIndex, index);\n}\n\nfunction textReplacement(code: number): string | undefined {\n  switch (code) {\n    case 38:\n      return \"&amp;\";\n    case 60:\n      return \"&lt;\";\n    case 62:\n      return \"&gt;\";\n    default:\n      return undefined;\n  }\n}\n\nfunction attributeReplacement(code: number): string | undefined {\n  if (code === 34) {\n    return \"&quot;\";\n  }\n\n  if (code === 39) {\n    return \"&#39;\";\n  }\n\n  return textReplacement(code);\n}\n\nfunction quotedAttributeReplacement(code: number): string | undefined {\n  switch (code) {\n    case 34:\n      return \"&quot;\";\n    case 38:\n      return \"&amp;\";\n    default:\n      return undefined;\n  }\n}\n"]}

package/dist/url-safety.d.ts

@@ -1,10 +1,17 @@
+/** Returns true for HTML attributes that require explicit unsafe-HTML opt-in handling. */
 export declare function isDangerousHtmlAttribute(name: string): boolean;
+/** Narrows a value to an explicit raw HTML opt-in payload. */
 export declare function isDangerousHtmlOptIn(value: unknown): value is {
     __html: string;
 };
+/** Returns true when an attribute name normally carries a single URL value. */
 export declare function isUrlAttribute(name: string): boolean;
+/** Returns true when an attribute name carries a srcset-style URL list. */
 export declare function isSrcsetAttribute(name: string): boolean;
+/** Checks whether an HTML URL-bearing attribute value uses a blocked scheme. */
 export declare function isUnsafeUrlAttribute(name: string, value: string): boolean;
+/** Returns the original URL attribute value when it is safe, otherwise undefined. */
 export declare function safeUrlAttributeValue(name: string, value: string): string | undefined;
+/** Checks whether a meta refresh content value redirects to an unsafe URL. */
 export declare function isUnsafeMetaRefreshContent(httpEquiv: string, content: string): boolean;
 //# sourceMappingURL=url-safety.d.ts.map

package/dist/url-safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-safety.d.ts","sourceRoot":"","sources":["../src/url-safety.ts"],"names":[],"mappings":"AA4BA,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAO7B;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAczE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErF;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKtF"}
+{"version":3,"file":"url-safety.d.ts","sourceRoot":"","sources":["../src/url-safety.ts"],"names":[],"mappings":"AA4BA,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAO7B;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAczE;AAED,qFAAqF;AACrF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErF;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKtF"}

package/dist/url-safety.js

@@ -21,21 +21,26 @@ const UNSAFE_URL_SCHEMES = new Set([
     "mhtml",
     "file",
 ]);
+/** Returns true for HTML attributes that require explicit unsafe-HTML opt-in handling. */
 export function isDangerousHtmlAttribute(name) {
     return DANGEROUS_HTML_ATTRIBUTE_NAMES.has(name);
 }
+/** Narrows a value to an explicit raw HTML opt-in payload. */
 export function isDangerousHtmlOptIn(value) {
     return (typeof value === "object" &&
         value !== null &&
         "__html" in value &&
         typeof value.__html === "string");
 }
+/** Returns true when an attribute name normally carries a single URL value. */
 export function isUrlAttribute(name) {
     return URL_ATTRIBUTE_NAMES.has(name);
 }
+/** Returns true when an attribute name carries a srcset-style URL list. */
 export function isSrcsetAttribute(name) {
     return SRCSET_ATTRIBUTE_NAMES.has(name);
 }
+/** Checks whether an HTML URL-bearing attribute value uses a blocked scheme. */
 export function isUnsafeUrlAttribute(name, value) {
     if (isUrlAttribute(name)) {
         return isUnsafeUrlValueForName(name, value);
@@ -53,9 +58,11 @@ export function isUnsafeUrlAttribute(name, value) {
     }
     return false;
 }
+/** Returns the original URL attribute value when it is safe, otherwise undefined. */
 export function safeUrlAttributeValue(name, value) {
     return isUnsafeUrlAttribute(name, value) ? undefined : value;
 }
+/** Checks whether a meta refresh content value redirects to an unsafe URL. */
 export function isUnsafeMetaRefreshContent(httpEquiv, content) {
     if (httpEquiv.toLowerCase() !== "refresh")
         return false;

package/dist/url-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-safety.js","sourceRoot":"","sources":["../src/url-safety.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,sDAAsD;AAEtD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM;IACN,KAAK;IACL,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAElE,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAE3D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,QAAQ,IAAI,KAAK;QACjB,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,KAAa;IAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACvD,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,GAAG,KAAK,EAAE;gBAAE,SAAS;YACzB,IAAI,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAa;IAC/D,OAAO,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,OAAe;IAC3E,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,uBAAuB,CAAC,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAa;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/D,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC/D,IAAI,sCAAsC,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["// Canonical URL and HTML-attribute safety helpers shared across server,\n// React compatibility, and reactive DOM render paths.\n\nconst URL_ATTRIBUTE_NAMES = new Set([\n  \"href\",\n  \"src\",\n  \"action\",\n  \"formaction\",\n  \"xlink:href\",\n  \"ping\",\n  \"poster\",\n  \"background\",\n  \"manifest\",\n]);\n\nconst SRCSET_ATTRIBUTE_NAMES = new Set([\"srcset\", \"imagesrcset\"]);\n\nconst DANGEROUS_HTML_ATTRIBUTE_NAMES = new Set([\"srcdoc\"]);\n\nconst UNSAFE_URL_SCHEMES = new Set([\n  \"javascript\",\n  \"data\",\n  \"vbscript\",\n  \"livescript\",\n  \"mhtml\",\n  \"file\",\n]);\n\nexport function isDangerousHtmlAttribute(name: string): boolean {\n  return DANGEROUS_HTML_ATTRIBUTE_NAMES.has(name);\n}\n\nexport function isDangerousHtmlOptIn(\n  value: unknown,\n): value is { __html: string } {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    \"__html\" in value &&\n    typeof (value as { __html?: unknown }).__html === \"string\"\n  );\n}\n\nexport function isUrlAttribute(name: string): boolean {\n  return URL_ATTRIBUTE_NAMES.has(name);\n}\n\nexport function isSrcsetAttribute(name: string): boolean {\n  return SRCSET_ATTRIBUTE_NAMES.has(name);\n}\n\nexport function isUnsafeUrlAttribute(name: string, value: string): boolean {\n  if (isUrlAttribute(name)) {\n    return isUnsafeUrlValueForName(name, value);\n  }\n  if (isSrcsetAttribute(name)) {\n    const canonical = canonicalizeUrlForSchemeCheck(value);\n    for (const candidate of canonical.split(\",\")) {\n      const url = candidate.trim().split(/\\s+/)[0] ?? \"\";\n      if (url === \"\") continue;\n      if (isUnsafeUrlValueForName(\"src\", url)) return true;\n    }\n    return false;\n  }\n  return false;\n}\n\nexport function safeUrlAttributeValue(name: string, value: string): string | undefined {\n  return isUnsafeUrlAttribute(name, value) ? undefined : value;\n}\n\nexport function isUnsafeMetaRefreshContent(httpEquiv: string, content: string): boolean {\n  if (httpEquiv.toLowerCase() !== \"refresh\") return false;\n  const match = /^[^;]*;\\s*url\\s*=\\s*([\\s\\S]+)$/iu.exec(content);\n  if (match === null || match[1] === undefined) return false;\n  return isUnsafeUrlValueForName(\"href\", stripSurroundingQuotes(match[1].trim()));\n}\n\nfunction stripSurroundingQuotes(value: string): string {\n  if (value.length < 2) return value;\n\n  const quote = value[0];\n  if ((quote === '\"' || quote === \"'\") && value[value.length - 1] === quote) {\n    return value.slice(1, -1).trim();\n  }\n\n  return value;\n}\n\nfunction canonicalizeUrlForSchemeCheck(value: string): string {\n  let start = 0;\n\n  while (start < value.length && value.charCodeAt(start) <= 0x20) {\n    start += 1;\n  }\n\n  return value.slice(start).replace(/[\\t\\r\\n]/g, \"\");\n}\n\nfunction schemeOf(value: string): string | undefined {\n  const match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(value);\n  if (match === null || match[1] === undefined) return undefined;\n  return match[1].toLowerCase();\n}\n\nfunction isUnsafeUrlValueForName(name: string, value: string): boolean {\n  const canonical = canonicalizeUrlForSchemeCheck(value);\n  const scheme = schemeOf(canonical);\n  if (scheme === undefined) return false;\n  if (!UNSAFE_URL_SCHEMES.has(scheme)) return false;\n  if (scheme === \"data\" && (name === \"src\" || name === \"poster\")) {\n    if (/^data:image\\/(?!svg\\+xml(?:[;,]|$))/i.test(canonical)) return false;\n  }\n  return true;\n}\n"]}
+{"version":3,"file":"url-safety.js","sourceRoot":"","sources":["../src/url-safety.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,sDAAsD;AAEtD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM;IACN,KAAK;IACL,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAElE,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAE3D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAClC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,QAAQ,IAAI,KAAK;QACjB,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ,CAC3D,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,KAAa;IAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACvD,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,GAAG,KAAK,EAAE;gBAAE,SAAS;YACzB,IAAI,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAa;IAC/D,OAAO,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,OAAe;IAC3E,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,uBAAuB,CAAC,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAa;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/D,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC/D,IAAI,sCAAsC,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["// Canonical URL and HTML-attribute safety helpers shared across server,\n// React compatibility, and reactive DOM render paths.\n\nconst URL_ATTRIBUTE_NAMES = new Set([\n  \"href\",\n  \"src\",\n  \"action\",\n  \"formaction\",\n  \"xlink:href\",\n  \"ping\",\n  \"poster\",\n  \"background\",\n  \"manifest\",\n]);\n\nconst SRCSET_ATTRIBUTE_NAMES = new Set([\"srcset\", \"imagesrcset\"]);\n\nconst DANGEROUS_HTML_ATTRIBUTE_NAMES = new Set([\"srcdoc\"]);\n\nconst UNSAFE_URL_SCHEMES = new Set([\n  \"javascript\",\n  \"data\",\n  \"vbscript\",\n  \"livescript\",\n  \"mhtml\",\n  \"file\",\n]);\n\n/** Returns true for HTML attributes that require explicit unsafe-HTML opt-in handling. */\nexport function isDangerousHtmlAttribute(name: string): boolean {\n  return DANGEROUS_HTML_ATTRIBUTE_NAMES.has(name);\n}\n\n/** Narrows a value to an explicit raw HTML opt-in payload. */\nexport function isDangerousHtmlOptIn(\n  value: unknown,\n): value is { __html: string } {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    \"__html\" in value &&\n    typeof (value as { __html?: unknown }).__html === \"string\"\n  );\n}\n\n/** Returns true when an attribute name normally carries a single URL value. */\nexport function isUrlAttribute(name: string): boolean {\n  return URL_ATTRIBUTE_NAMES.has(name);\n}\n\n/** Returns true when an attribute name carries a srcset-style URL list. */\nexport function isSrcsetAttribute(name: string): boolean {\n  return SRCSET_ATTRIBUTE_NAMES.has(name);\n}\n\n/** Checks whether an HTML URL-bearing attribute value uses a blocked scheme. */\nexport function isUnsafeUrlAttribute(name: string, value: string): boolean {\n  if (isUrlAttribute(name)) {\n    return isUnsafeUrlValueForName(name, value);\n  }\n  if (isSrcsetAttribute(name)) {\n    const canonical = canonicalizeUrlForSchemeCheck(value);\n    for (const candidate of canonical.split(\",\")) {\n      const url = candidate.trim().split(/\\s+/)[0] ?? \"\";\n      if (url === \"\") continue;\n      if (isUnsafeUrlValueForName(\"src\", url)) return true;\n    }\n    return false;\n  }\n  return false;\n}\n\n/** Returns the original URL attribute value when it is safe, otherwise undefined. */\nexport function safeUrlAttributeValue(name: string, value: string): string | undefined {\n  return isUnsafeUrlAttribute(name, value) ? undefined : value;\n}\n\n/** Checks whether a meta refresh content value redirects to an unsafe URL. */\nexport function isUnsafeMetaRefreshContent(httpEquiv: string, content: string): boolean {\n  if (httpEquiv.toLowerCase() !== \"refresh\") return false;\n  const match = /^[^;]*;\\s*url\\s*=\\s*([\\s\\S]+)$/iu.exec(content);\n  if (match === null || match[1] === undefined) return false;\n  return isUnsafeUrlValueForName(\"href\", stripSurroundingQuotes(match[1].trim()));\n}\n\nfunction stripSurroundingQuotes(value: string): string {\n  if (value.length < 2) return value;\n\n  const quote = value[0];\n  if ((quote === '\"' || quote === \"'\") && value[value.length - 1] === quote) {\n    return value.slice(1, -1).trim();\n  }\n\n  return value;\n}\n\nfunction canonicalizeUrlForSchemeCheck(value: string): string {\n  let start = 0;\n\n  while (start < value.length && value.charCodeAt(start) <= 0x20) {\n    start += 1;\n  }\n\n  return value.slice(start).replace(/[\\t\\r\\n]/g, \"\");\n}\n\nfunction schemeOf(value: string): string | undefined {\n  const match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(value);\n  if (match === null || match[1] === undefined) return undefined;\n  return match[1].toLowerCase();\n}\n\nfunction isUnsafeUrlValueForName(name: string, value: string): boolean {\n  const canonical = canonicalizeUrlForSchemeCheck(value);\n  const scheme = schemeOf(canonical);\n  if (scheme === undefined) return false;\n  if (!UNSAFE_URL_SCHEMES.has(scheme)) return false;\n  if (scheme === \"data\" && (name === \"src\" || name === \"poster\")) {\n    if (/^data:image\\/(?!svg\\+xml(?:[;,]|$))/i.test(canonical)) return false;\n  }\n  return true;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reckona/mreact-shared",
-  "version": "0.0.160",
+  "version": "0.0.162",
   "description": "Shared runtime utilities used by mreact packages.",
   "keywords": [
     "jsx",

package/src/compiler-contract.ts

@@ -1,7 +1,10 @@
+/** Version number for the compiler output metadata contract consumed by runtime packages. */
 export const compilerOutputContractVersion = 1;
 
+/** Server rendering mode requested for transformed component output. */
 export type ServerOutputMode = "string" | "stream";
 
+/** Receives HTML chunks and deferred work while server rendering. */
 export interface HtmlSink {
   append(chunk: string): void;
   backpressure?(): Promise<void>;
@@ -9,6 +12,7 @@ export interface HtmlSink {
   signal?: AbortSignal;
 }
 
+/** Complete source transform result emitted by a compiler frontend. */
 export interface TransformOutput {
   code: string;
   map?: string | null;
@@ -16,6 +20,7 @@ export interface TransformOutput {
   metadata: ModuleMetadata;
 }
 
+/** Compiler diagnostic reported for a transformed source module. */
 export interface Diagnostic {
   level: "info" | "warn" | "error";
   code: string;
@@ -24,17 +29,20 @@ export interface Diagnostic {
   suggestion?: DiagnosticSuggestion;
 }
 
+/** Suggested action or reference attached to a compiler diagnostic. */
 export interface DiagnosticSuggestion {
   title: string;
   replacement?: string;
   link?: string;
 }
 
+/** One-based source location used by compiler diagnostics. */
 export interface SourceLocation {
   line: number;
   column: number;
 }
 
+/** Metadata that describes the transformed module and its runtime dependencies. */
 export interface ModuleMetadata {
   filename: string;
   target: CompileTarget;
@@ -54,36 +62,45 @@ export interface ModuleMetadata {
   eventHydrationManifest?: EventHydrationManifestMetadata;
 }
 
+/** Compilation target used to select client or server output. */
 export type CompileTarget = "client" | "server";
+/** Bootstrap script mode requested by server output metadata. */
 export type ServerBootstrapMode = "none" | "out-of-order-reorder";
+/** Compiler frontend implementation that produced a transform result. */
 export type CompilerFrontend = "oxc";
 
+/** Compiler implementation metadata stored with a transform result. */
 export interface CompilerMetadata {
   frontend: CompilerFrontend;
   typescriptFallback: boolean;
 }
 
+/** Client component export recorded for React Flight manifests. */
 export interface ClientReferenceMetadata {
   name: string;
   moduleId: string;
   exportName: string;
 }
 
+/** Component export discovered by the compiler for runtime registration. */
 export interface ComponentMetadata {
   name: string;
   exportName: string;
 }
 
+/** Runtime import required by transformed source output. */
 export interface RuntimeImport {
   source: string;
   specifiers: string[];
 }
 
+/** Event hydration manifest metadata emitted with transformed server output. */
 export interface EventHydrationManifestMetadata {
   version: 1;
   events: EventHydrationEntryMetadata[];
 }
 
+/** Event handler hydration entry recorded by the compiler. */
 export interface EventHydrationEntryMetadata {
   id: string;
   event: string;

package/src/html-elements.ts

@@ -15,6 +15,7 @@ const voidHtmlElementNames = new Set([
   "wbr",
 ]);
 
+/** Returns true when an HTML tag is a void element that cannot have children. */
 export function isVoidHtmlElement(tagName: string): boolean {
   return voidHtmlElementNames.has(tagName);
 }

package/src/html-escape.ts

@@ -2,14 +2,17 @@ const textEscapePattern = /[&<>]/;
 const attributeEscapePattern = /["&'<>]/;
 const quotedAttributeEscapePattern = /["&]/;
 
+/** Escapes text content for safe insertion between HTML tags. */
 export function escapeHtmlText(value: unknown): string {
   return escapeHtml(String(value), textEscapePattern, textReplacement);
 }
 
+/** Escapes a value for safe use in an HTML attribute. */
 export function escapeHtmlAttribute(value: unknown): string {
   return escapeHtml(String(value), attributeEscapePattern, attributeReplacement);
 }
 
+/** Escapes a value for safe use inside an already quoted HTML attribute. */
 export function escapeHtmlQuotedAttribute(value: unknown): string {
   return escapeHtml(String(value), quotedAttributeEscapePattern, quotedAttributeReplacement);
 }

package/src/url-safety.ts

@@ -26,10 +26,12 @@ const UNSAFE_URL_SCHEMES = new Set([
   "file",
 ]);
 
+/** Returns true for HTML attributes that require explicit unsafe-HTML opt-in handling. */
 export function isDangerousHtmlAttribute(name: string): boolean {
   return DANGEROUS_HTML_ATTRIBUTE_NAMES.has(name);
 }
 
+/** Narrows a value to an explicit raw HTML opt-in payload. */
 export function isDangerousHtmlOptIn(
   value: unknown,
 ): value is { __html: string } {
@@ -41,14 +43,17 @@ export function isDangerousHtmlOptIn(
   );
 }
 
+/** Returns true when an attribute name normally carries a single URL value. */
 export function isUrlAttribute(name: string): boolean {
   return URL_ATTRIBUTE_NAMES.has(name);
 }
 
+/** Returns true when an attribute name carries a srcset-style URL list. */
 export function isSrcsetAttribute(name: string): boolean {
   return SRCSET_ATTRIBUTE_NAMES.has(name);
 }
 
+/** Checks whether an HTML URL-bearing attribute value uses a blocked scheme. */
 export function isUnsafeUrlAttribute(name: string, value: string): boolean {
   if (isUrlAttribute(name)) {
     return isUnsafeUrlValueForName(name, value);
@@ -65,10 +70,12 @@ export function isUnsafeUrlAttribute(name: string, value: string): boolean {
   return false;
 }
 
+/** Returns the original URL attribute value when it is safe, otherwise undefined. */
 export function safeUrlAttributeValue(name: string, value: string): string | undefined {
   return isUnsafeUrlAttribute(name, value) ? undefined : value;
 }
 
+/** Checks whether a meta refresh content value redirects to an unsafe URL. */
 export function isUnsafeMetaRefreshContent(httpEquiv: string, content: string): boolean {
   if (httpEquiv.toLowerCase() !== "refresh") return false;
   const match = /^[^;]*;\s*url\s*=\s*([\s\S]+)$/iu.exec(content);