@transferwise/components 0.0.0-experimental-7ad3353 → 0.0.0-experimental-f5ce19a

package/build/Markup/utils/parseMarkup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseMarkup.js","sources":["../../../src/Markup/utils/parseMarkup.ts"],"sourcesContent":["import { ALLOWED_TARGETS, MAX_NESTING_DEPTH, TAG_ALIASES, TAG_REGEX } from '../constants';\nimport { MarkupNode } from '../Markup.types';\n\nexport { MAX_NESTING_DEPTH };\nexport const MAX_INPUT_LENGTH = 10_000;\nexport const MAX_ACCESSIBILITY_LABEL_LENGTH = 250;\n\nconst OBJECT_PROTOTYPE_KEYS = new Set(Object.getOwnPropertyNames(Object.prototype));\n\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\x00-\\x1f\\x7f-\\x9f]/g;\nconst HTML_METACHAR = /[<>\"']/g;\n\ntype Token =\n  | { type: 'text'; content: string }\n  | { type: 'newline' }\n  | { type: 'open'; tag: string; attrs: string }\n  | { type: 'close'; tag: string };\n\n/**\n * Splits the input string into a flat list of tokens by scanning for known tags.\n * Text between tags is emitted as text/newline tokens. Unrecognised tags are never\n * tokenised — they remain part of the surrounding text content.\n */\nfunction tokenise(input: string): Token[] {\n  const tokens: Token[] = [];\n  let lastIndex = 0;\n\n  TAG_REGEX.lastIndex = 0;\n  let match = TAG_REGEX.exec(input);\n\n  while (match !== null) {\n    if (match.index > lastIndex) {\n      pushTextWithNewlines(tokens, input.slice(lastIndex, match.index));\n    }\n\n    const isClose = match[1] === '/';\n    const tag = match[2];\n    const attrs = match[3] || '';\n\n    if (isClose) {\n      tokens.push({ type: 'close', tag });\n    } else {\n      tokens.push({ type: 'open', tag, attrs });\n    }\n\n    lastIndex = TAG_REGEX.lastIndex;\n    match = TAG_REGEX.exec(input);\n  }\n\n  if (lastIndex < input.length) {\n    pushTextWithNewlines(tokens, input.slice(lastIndex));\n  }\n\n  return tokens;\n}\n\n/** Splits a text fragment on newline characters, interleaving newline tokens between parts. */\nfunction pushTextWithNewlines(tokens: Token[], text: string): void {\n  const parts = text.split('\\n');\n  for (let index = 0; index < parts.length; index += 1) {\n    if (index > 0) {\n      tokens.push({ type: 'newline' });\n    }\n    if (parts[index]) {\n      tokens.push({ type: 'text', content: parts[index] });\n    }\n  }\n}\n\ntype ParseResult = { closed: true; nodes: MarkupNode[] } | { closed: false; nodes: MarkupNode[] };\n\n/**\n * Recursive descent parser that consumes tokens and builds a MarkupNode tree.\n *\n * When `untilTag` is provided, the function collects nodes until it finds a matching\n * close token — returning `{ closed: true }`. If it exhausts all tokens without finding\n * the close, it returns `{ closed: false }` so the caller can fall back to plain text\n * (graceful degradation for malformed input).\n *\n * The shared `position` object acts as a cursor across recursive calls, avoiding the\n * need to slice or copy the token array.\n */\nfunction parse(\n  tokens: Token[],\n  position: { index: number },\n  untilTag?: string,\n  depth = 0,\n): ParseResult {\n  const nodes: MarkupNode[] = [];\n\n  while (position.index < tokens.length) {\n    const token = tokens[position.index];\n\n    if (token.type === 'text') {\n      nodes.push({ type: 'text', content: token.content });\n      position.index += 1;\n    } else if (token.type === 'newline') {\n      nodes.push({ type: 'newline' });\n      position.index += 1;\n    } else if (token.type === 'close') {\n      if (token.tag === untilTag) {\n        position.index += 1;\n        return { closed: true, nodes };\n      }\n      // Mismatched close tag — render as literal text\n      nodes.push({ type: 'text', content: `</${token.tag}>` });\n      position.index += 1;\n    } else if (token.type === 'open') {\n      if (depth >= MAX_NESTING_DEPTH) {\n        nodes.push({ type: 'text', content: `<${token.tag}${token.attrs}>` });\n        position.index += 1;\n      } else {\n        position.index += 1;\n        const result = parse(tokens, position, token.tag, depth + 1);\n\n        if (result.closed) {\n          const node = buildNode(token.tag, token.attrs, result.nodes);\n          nodes.push(node);\n        } else {\n          nodes.push({ type: 'text', content: `<${token.tag}${token.attrs}>` });\n          nodes.push(...result.nodes);\n        }\n      }\n    }\n  }\n\n  if (untilTag) {\n    return { closed: false, nodes };\n  }\n\n  return { closed: true, nodes };\n}\n\n/**\n * Maps a raw tag name to a typed MarkupNode. Resolves aliases first (p→paragraph, a→link),\n * then builds the appropriate node shape. Link nodes carry full attributes; other element\n * nodes extract only accessibilityLabel.\n */\nfunction buildNode(rawTag: string, attrs: string, children: MarkupNode[]): MarkupNode {\n  const tag = TAG_ALIASES[rawTag] || rawTag;\n\n  if (tag === 'link') {\n    return { type: 'link', children, ...parseAttributes(attrs) };\n  }\n\n  if (tag === 'paragraph') {\n    return { type: 'paragraph', children };\n  }\n\n  const { accessibilityLabel } = parseAttributes(attrs);\n\n  return {\n    type: tag as MarkupNode['type'],\n    children,\n    ...(accessibilityLabel && { accessibilityLabel }),\n  } as MarkupNode;\n}\n\nconst ATTR_REGEX = /(?<=\\s)(href|action|target|accessibilityLabel)=(?:\"([^\"]*)\"|'([^']*)')/g;\n\ntype ParsedAttributes = {\n  href?: string;\n  action?: string;\n  target?: string;\n  accessibilityLabel?: string;\n};\n\n/**\n * Extracts allowed attributes from a raw attribute string.\n * Supports both double- and single-quoted values. Any attribute not in the\n * allow-list (href, action, target, accessibilityLabel) is silently discarded.\n * First occurrence wins — duplicates are ignored.\n */\nfunction parseAttributes(attrs: string): ParsedAttributes {\n  const result: ParsedAttributes = {};\n  ATTR_REGEX.lastIndex = 0;\n  let match = ATTR_REGEX.exec(attrs);\n\n  while (match !== null) {\n    const key = match[1] as 'href' | 'action' | 'target' | 'accessibilityLabel';\n    const value = match[2] ?? match[3];\n\n    if (!(key in result)) {\n      const sanitized = sanitizeAttributeValue(key, value);\n      if (sanitized !== undefined) {\n        result[key] = sanitized;\n      }\n    }\n\n    match = ATTR_REGEX.exec(attrs);\n  }\n\n  return result;\n}\n\nfunction sanitizeAttributeValue(\n  key: 'href' | 'action' | 'target' | 'accessibilityLabel',\n  value: string,\n): string | undefined {\n  switch (key) {\n    case 'href':\n      return value.replace(CONTROL_CHARS, '');\n    case 'action':\n      if (OBJECT_PROTOTYPE_KEYS.has(value)) {\n        return undefined;\n      }\n      return value;\n    case 'target':\n      if (!ALLOWED_TARGETS.includes(value)) {\n        return undefined;\n      }\n      return value;\n    case 'accessibilityLabel':\n      return value.replace(HTML_METACHAR, '').slice(0, MAX_ACCESSIBILITY_LABEL_LENGTH);\n    default:\n      return value;\n  }\n}\n\n/** Entry point: tokenises the input string, then parses the token stream into a MarkupNode tree. */\nexport function parseMarkup(input: string): MarkupNode[] {\n  if (!input) {\n    return [];\n  }\n\n  if (input.length > MAX_INPUT_LENGTH) {\n    return [{ type: 'text', content: input }];\n  }\n\n  const tokens = tokenise(input);\n  const position = { index: 0 };\n  return parse(tokens, position).nodes;\n}\n"],"names":["MAX_INPUT_LENGTH","MAX_ACCESSIBILITY_LABEL_LENGTH","OBJECT_PROTOTYPE_KEYS","Set","Object","getOwnPropertyNames","prototype","CONTROL_CHARS","HTML_METACHAR","tokenise","input","tokens","lastIndex","TAG_REGEX","match","exec","index","pushTextWithNewlines","slice","isClose","tag","attrs","push","type","length","text","parts","split","content","parse","position","untilTag","depth","nodes","token","closed","MAX_NESTING_DEPTH","result","node","buildNode","rawTag","children","TAG_ALIASES","parseAttributes","accessibilityLabel","ATTR_REGEX","key","value","sanitized","sanitizeAttributeValue","undefined","replace","has","ALLOWED_TARGETS","includes","parseMarkup"],"mappings":";;;;AAIO,MAAMA,gBAAgB,GAAG;AACzB,MAAMC,8BAA8B,GAAG;AAE9C,MAAMC,qBAAqB,GAAG,IAAIC,GAAG,CAACC,MAAM,CAACC,mBAAmB,CAACD,MAAM,CAACE,SAAS,CAAC,CAAC;AAEnF;AACA,MAAMC,aAAa,GAAG,uBAAuB;AAC7C,MAAMC,aAAa,GAAG,SAAS;AAQ/B;;;;AAIG;AACH,SAASC,QAAQA,CAACC,KAAa,EAAA;EAC7B,MAAMC,MAAM,GAAY,EAAE;EAC1B,IAAIC,SAAS,GAAG,CAAC;EAEjBC,mBAAS,CAACD,SAAS,GAAG,CAAC;AACvB,EAAA,IAAIE,KAAK,GAAGD,mBAAS,CAACE,IAAI,CAACL,KAAK,CAAC;EAEjC,OAAOI,KAAK,KAAK,IAAI,EAAE;AACrB,IAAA,IAAIA,KAAK,CAACE,KAAK,GAAGJ,SAAS,EAAE;AAC3BK,MAAAA,oBAAoB,CAACN,MAAM,EAAED,KAAK,CAACQ,KAAK,CAACN,SAAS,EAAEE,KAAK,CAACE,KAAK,CAAC,CAAC;AACnE,IAAA;AAEA,IAAA,MAAMG,OAAO,GAAGL,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;AAChC,IAAA,MAAMM,GAAG,GAAGN,KAAK,CAAC,CAAC,CAAC;AACpB,IAAA,MAAMO,KAAK,GAAGP,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;AAE5B,IAAA,IAAIK,OAAO,EAAE;MACXR,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,OAAO;AAAEH,QAAAA;AAAG,OAAE,CAAC;AACrC,IAAA,CAAC,MAAM;MACLT,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;QAAEH,GAAG;AAAEC,QAAAA;AAAK,OAAE,CAAC;AAC3C,IAAA;IAEAT,SAAS,GAAGC,mBAAS,CAACD,SAAS;AAC/BE,IAAAA,KAAK,GAAGD,mBAAS,CAACE,IAAI,CAACL,KAAK,CAAC;AAC/B,EAAA;AAEA,EAAA,IAAIE,SAAS,GAAGF,KAAK,CAACc,MAAM,EAAE;IAC5BP,oBAAoB,CAACN,MAAM,EAAED,KAAK,CAACQ,KAAK,CAACN,SAAS,CAAC,CAAC;AACtD,EAAA;AAEA,EAAA,OAAOD,MAAM;AACf;AAEA;AACA,SAASM,oBAAoBA,CAACN,MAAe,EAAEc,IAAY,EAAA;AACzD,EAAA,MAAMC,KAAK,GAAGD,IAAI,CAACE,KAAK,CAAC,IAAI,CAAC;AAC9B,EAAA,KAAK,IAAIX,KAAK,GAAG,CAAC,EAAEA,KAAK,GAAGU,KAAK,CAACF,MAAM,EAAER,KAAK,IAAI,CAAC,EAAE;IACpD,IAAIA,KAAK,GAAG,CAAC,EAAE;MACbL,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE;AAAS,OAAE,CAAC;AAClC,IAAA;AACA,IAAA,IAAIG,KAAK,CAACV,KAAK,CAAC,EAAE;MAChBL,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;QAAEK,OAAO,EAAEF,KAAK,CAACV,KAAK;AAAC,OAAE,CAAC;AACtD,IAAA;AACF,EAAA;AACF;AAIA;;;;;;;;;;AAUG;AACH,SAASa,KAAKA,CACZlB,MAAe,EACfmB,QAA2B,EAC3BC,QAAiB,EACjBC,KAAK,GAAG,CAAC,EAAA;EAET,MAAMC,KAAK,GAAiB,EAAE;AAE9B,EAAA,OAAOH,QAAQ,CAACd,KAAK,GAAGL,MAAM,CAACa,MAAM,EAAE;AACrC,IAAA,MAAMU,KAAK,GAAGvB,MAAM,CAACmB,QAAQ,CAACd,KAAK,CAAC;AAEpC,IAAA,IAAIkB,KAAK,CAACX,IAAI,KAAK,MAAM,EAAE;MACzBU,KAAK,CAACX,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;QAAEK,OAAO,EAAEM,KAAK,CAACN;AAAO,OAAE,CAAC;MACpDE,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,IAAA,CAAC,MAAM,IAAIkB,KAAK,CAACX,IAAI,KAAK,SAAS,EAAE;MACnCU,KAAK,CAACX,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE;AAAS,OAAE,CAAC;MAC/BO,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,IAAA,CAAC,MAAM,IAAIkB,KAAK,CAACX,IAAI,KAAK,OAAO,EAAE;AACjC,MAAA,IAAIW,KAAK,CAACd,GAAG,KAAKW,QAAQ,EAAE;QAC1BD,QAAQ,CAACd,KAAK,IAAI,CAAC;QACnB,OAAO;AAAEmB,UAAAA,MAAM,EAAE,IAAI;AAAEF,UAAAA;SAAO;AAChC,MAAA;AACA;MACAA,KAAK,CAACX,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;AAAEK,QAAAA,OAAO,EAAE,CAAA,EAAA,EAAKM,KAAK,CAACd,GAAG,CAAA,CAAA;AAAG,OAAE,CAAC;MACxDU,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,IAAA,CAAC,MAAM,IAAIkB,KAAK,CAACX,IAAI,KAAK,MAAM,EAAE;MAChC,IAAIS,KAAK,IAAII,2BAAiB,EAAE;QAC9BH,KAAK,CAACX,IAAI,CAAC;AAAEC,UAAAA,IAAI,EAAE,MAAM;UAAEK,OAAO,EAAE,IAAIM,KAAK,CAACd,GAAG,CAAA,EAAGc,KAAK,CAACb,KAAK,CAAA,CAAA;AAAG,SAAE,CAAC;QACrES,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,MAAA,CAAC,MAAM;QACLc,QAAQ,CAACd,KAAK,IAAI,CAAC;AACnB,QAAA,MAAMqB,MAAM,GAAGR,KAAK,CAAClB,MAAM,EAAEmB,QAAQ,EAAEI,KAAK,CAACd,GAAG,EAAEY,KAAK,GAAG,CAAC,CAAC;QAE5D,IAAIK,MAAM,CAACF,MAAM,EAAE;AACjB,UAAA,MAAMG,IAAI,GAAGC,SAAS,CAACL,KAAK,CAACd,GAAG,EAAEc,KAAK,CAACb,KAAK,EAAEgB,MAAM,CAACJ,KAAK,CAAC;AAC5DA,UAAAA,KAAK,CAACX,IAAI,CAACgB,IAAI,CAAC;AAClB,QAAA,CAAC,MAAM;UACLL,KAAK,CAACX,IAAI,CAAC;AAAEC,YAAAA,IAAI,EAAE,MAAM;YAAEK,OAAO,EAAE,IAAIM,KAAK,CAACd,GAAG,CAAA,EAAGc,KAAK,CAACb,KAAK,CAAA,CAAA;AAAG,WAAE,CAAC;AACrEY,UAAAA,KAAK,CAACX,IAAI,CAAC,GAAGe,MAAM,CAACJ,KAAK,CAAC;AAC7B,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA,IAAIF,QAAQ,EAAE;IACZ,OAAO;AAAEI,MAAAA,MAAM,EAAE,KAAK;AAAEF,MAAAA;KAAO;AACjC,EAAA;EAEA,OAAO;AAAEE,IAAAA,MAAM,EAAE,IAAI;AAAEF,IAAAA;GAAO;AAChC;AAEA;;;;AAIG;AACH,SAASM,SAASA,CAACC,MAAc,EAAEnB,KAAa,EAAEoB,QAAsB,EAAA;AACtE,EAAA,MAAMrB,GAAG,GAAGsB,qBAAW,CAACF,MAAM,CAAC,IAAIA,MAAM;EAEzC,IAAIpB,GAAG,KAAK,MAAM,EAAE;IAClB,OAAO;AAAEG,MAAAA,IAAI,EAAE,MAAM;MAAEkB,QAAQ;MAAE,GAAGE,eAAe,CAACtB,KAAK;KAAG;AAC9D,EAAA;EAEA,IAAID,GAAG,KAAK,WAAW,EAAE;IACvB,OAAO;AAAEG,MAAAA,IAAI,EAAE,WAAW;AAAEkB,MAAAA;KAAU;AACxC,EAAA;EAEA,MAAM;AAAEG,IAAAA;AAAkB,GAAE,GAAGD,eAAe,CAACtB,KAAK,CAAC;EAErD,OAAO;AACLE,IAAAA,IAAI,EAAEH,GAAyB;IAC/BqB,QAAQ;AACR,IAAA,IAAIG,kBAAkB,IAAI;AAAEA,MAAAA;KAAoB;GACnC;AACjB;AAEA,MAAMC,UAAU,GAAG,yEAAyE;AAS5F;;;;;AAKG;AACH,SAASF,eAAeA,CAACtB,KAAa,EAAA;EACpC,MAAMgB,MAAM,GAAqB,EAAE;EACnCQ,UAAU,CAACjC,SAAS,GAAG,CAAC;AACxB,EAAA,IAAIE,KAAK,GAAG+B,UAAU,CAAC9B,IAAI,CAACM,KAAK,CAAC;EAElC,OAAOP,KAAK,KAAK,IAAI,EAAE;AACrB,IAAA,MAAMgC,GAAG,GAAGhC,KAAK,CAAC,CAAC,CAAwD;IAC3E,MAAMiC,KAAK,GAAGjC,KAAK,CAAC,CAAC,CAAC,IAAIA,KAAK,CAAC,CAAC,CAAC;AAElC,IAAA,IAAI,EAAEgC,GAAG,IAAIT,MAAM,CAAC,EAAE;AACpB,MAAA,MAAMW,SAAS,GAAGC,sBAAsB,CAACH,GAAG,EAAEC,KAAK,CAAC;MACpD,IAAIC,SAAS,KAAKE,SAAS,EAAE;AAC3Bb,QAAAA,MAAM,CAACS,GAAG,CAAC,GAAGE,SAAS;AACzB,MAAA;AACF,IAAA;AAEAlC,IAAAA,KAAK,GAAG+B,UAAU,CAAC9B,IAAI,CAACM,KAAK,CAAC;AAChC,EAAA;AAEA,EAAA,OAAOgB,MAAM;AACf;AAEA,SAASY,sBAAsBA,CAC7BH,GAAwD,EACxDC,KAAa,EAAA;AAEb,EAAA,QAAQD,GAAG;AACT,IAAA,KAAK,MAAM;AACT,MAAA,OAAOC,KAAK,CAACI,OAAO,CAAC5C,aAAa,EAAE,EAAE,CAAC;AACzC,IAAA,KAAK,QAAQ;AACX,MAAA,IAAIL,qBAAqB,CAACkD,GAAG,CAACL,KAAK,CAAC,EAAE;AACpC,QAAA,OAAOG,SAAS;AAClB,MAAA;AACA,MAAA,OAAOH,KAAK;AACd,IAAA,KAAK,QAAQ;AACX,MAAA,IAAI,CAACM,yBAAe,CAACC,QAAQ,CAACP,KAAK,CAAC,EAAE;AACpC,QAAA,OAAOG,SAAS;AAClB,MAAA;AACA,MAAA,OAAOH,KAAK;AACd,IAAA,KAAK,oBAAoB;AACvB,MAAA,OAAOA,KAAK,CAACI,OAAO,CAAC3C,aAAa,EAAE,EAAE,CAAC,CAACU,KAAK,CAAC,CAAC,EAAEjB,8BAA8B,CAAC;AAClF,IAAA;AACE,MAAA,OAAO8C,KAAK;AAChB;AACF;AAEA;AACM,SAAUQ,WAAWA,CAAC7C,KAAa,EAAA;EACvC,IAAI,CAACA,KAAK,EAAE;AACV,IAAA,OAAO,EAAE;AACX,EAAA;AAEA,EAAA,IAAIA,KAAK,CAACc,MAAM,GAAGxB,gBAAgB,EAAE;AACnC,IAAA,OAAO,CAAC;AAAEuB,MAAAA,IAAI,EAAE,MAAM;AAAEK,MAAAA,OAAO,EAAElB;AAAK,KAAE,CAAC;AAC3C,EAAA;AAEA,EAAA,MAAMC,MAAM,GAAGF,QAAQ,CAACC,KAAK,CAAC;AAC9B,EAAA,MAAMoB,QAAQ,GAAG;AAAEd,IAAAA,KAAK,EAAE;GAAG;AAC7B,EAAA,OAAOa,KAAK,CAAClB,MAAM,EAAEmB,QAAQ,CAAC,CAACG,KAAK;AACtC;;;;;;;"}

package/build/Markup/utils/parseMarkup.mjs

@@ -0,0 +1,231 @@
+import { TAG_REGEX, MAX_NESTING_DEPTH, TAG_ALIASES, ALLOWED_TARGETS } from '../constants.mjs';
+
+const MAX_INPUT_LENGTH = 10_000;
+const MAX_ACCESSIBILITY_LABEL_LENGTH = 250;
+const OBJECT_PROTOTYPE_KEYS = new Set(Object.getOwnPropertyNames(Object.prototype));
+// eslint-disable-next-line regexp/no-control-character
+const CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+const HTML_METACHAR = /[<>"']/g;
+/**
+ * Splits the input string into a flat list of tokens by scanning for known tags.
+ * Text between tags is emitted as text/newline tokens. Unrecognised tags are never
+ * tokenised — they remain part of the surrounding text content.
+ */
+function tokenise(input) {
+  const tokens = [];
+  let lastIndex = 0;
+  TAG_REGEX.lastIndex = 0;
+  let match = TAG_REGEX.exec(input);
+  while (match !== null) {
+    if (match.index > lastIndex) {
+      pushTextWithNewlines(tokens, input.slice(lastIndex, match.index));
+    }
+    const isClose = match[1] === '/';
+    const tag = match[2];
+    const attrs = match[3] || '';
+    if (isClose) {
+      tokens.push({
+        type: 'close',
+        tag
+      });
+    } else {
+      tokens.push({
+        type: 'open',
+        tag,
+        attrs
+      });
+    }
+    lastIndex = TAG_REGEX.lastIndex;
+    match = TAG_REGEX.exec(input);
+  }
+  if (lastIndex < input.length) {
+    pushTextWithNewlines(tokens, input.slice(lastIndex));
+  }
+  return tokens;
+}
+/** Splits a text fragment on newline characters, interleaving newline tokens between parts. */
+function pushTextWithNewlines(tokens, text) {
+  const parts = text.split('\n');
+  for (let index = 0; index < parts.length; index += 1) {
+    if (index > 0) {
+      tokens.push({
+        type: 'newline'
+      });
+    }
+    if (parts[index]) {
+      tokens.push({
+        type: 'text',
+        content: parts[index]
+      });
+    }
+  }
+}
+/**
+ * Recursive descent parser that consumes tokens and builds a MarkupNode tree.
+ *
+ * When `untilTag` is provided, the function collects nodes until it finds a matching
+ * close token — returning `{ closed: true }`. If it exhausts all tokens without finding
+ * the close, it returns `{ closed: false }` so the caller can fall back to plain text
+ * (graceful degradation for malformed input).
+ *
+ * The shared `position` object acts as a cursor across recursive calls, avoiding the
+ * need to slice or copy the token array.
+ */
+function parse(tokens, position, untilTag, depth = 0) {
+  const nodes = [];
+  while (position.index < tokens.length) {
+    const token = tokens[position.index];
+    if (token.type === 'text') {
+      nodes.push({
+        type: 'text',
+        content: token.content
+      });
+      position.index += 1;
+    } else if (token.type === 'newline') {
+      nodes.push({
+        type: 'newline'
+      });
+      position.index += 1;
+    } else if (token.type === 'close') {
+      if (token.tag === untilTag) {
+        position.index += 1;
+        return {
+          closed: true,
+          nodes
+        };
+      }
+      // Mismatched close tag — render as literal text
+      nodes.push({
+        type: 'text',
+        content: `</${token.tag}>`
+      });
+      position.index += 1;
+    } else if (token.type === 'open') {
+      if (depth >= MAX_NESTING_DEPTH) {
+        nodes.push({
+          type: 'text',
+          content: `<${token.tag}${token.attrs}>`
+        });
+        position.index += 1;
+      } else {
+        position.index += 1;
+        const result = parse(tokens, position, token.tag, depth + 1);
+        if (result.closed) {
+          const node = buildNode(token.tag, token.attrs, result.nodes);
+          nodes.push(node);
+        } else {
+          nodes.push({
+            type: 'text',
+            content: `<${token.tag}${token.attrs}>`
+          });
+          nodes.push(...result.nodes);
+        }
+      }
+    }
+  }
+  if (untilTag) {
+    return {
+      closed: false,
+      nodes
+    };
+  }
+  return {
+    closed: true,
+    nodes
+  };
+}
+/**
+ * Maps a raw tag name to a typed MarkupNode. Resolves aliases first (p→paragraph, a→link),
+ * then builds the appropriate node shape. Link nodes carry full attributes; other element
+ * nodes extract only accessibilityLabel.
+ */
+function buildNode(rawTag, attrs, children) {
+  const tag = TAG_ALIASES[rawTag] || rawTag;
+  if (tag === 'link') {
+    return {
+      type: 'link',
+      children,
+      ...parseAttributes(attrs)
+    };
+  }
+  if (tag === 'paragraph') {
+    return {
+      type: 'paragraph',
+      children
+    };
+  }
+  const {
+    accessibilityLabel
+  } = parseAttributes(attrs);
+  return {
+    type: tag,
+    children,
+    ...(accessibilityLabel && {
+      accessibilityLabel
+    })
+  };
+}
+const ATTR_REGEX = /(?<=\s)(href|action|target|accessibilityLabel)=(?:"([^"]*)"|'([^']*)')/g;
+/**
+ * Extracts allowed attributes from a raw attribute string.
+ * Supports both double- and single-quoted values. Any attribute not in the
+ * allow-list (href, action, target, accessibilityLabel) is silently discarded.
+ * First occurrence wins — duplicates are ignored.
+ */
+function parseAttributes(attrs) {
+  const result = {};
+  ATTR_REGEX.lastIndex = 0;
+  let match = ATTR_REGEX.exec(attrs);
+  while (match !== null) {
+    const key = match[1];
+    const value = match[2] ?? match[3];
+    if (!(key in result)) {
+      const sanitized = sanitizeAttributeValue(key, value);
+      if (sanitized !== undefined) {
+        result[key] = sanitized;
+      }
+    }
+    match = ATTR_REGEX.exec(attrs);
+  }
+  return result;
+}
+function sanitizeAttributeValue(key, value) {
+  switch (key) {
+    case 'href':
+      return value.replace(CONTROL_CHARS, '');
+    case 'action':
+      if (OBJECT_PROTOTYPE_KEYS.has(value)) {
+        return undefined;
+      }
+      return value;
+    case 'target':
+      if (!ALLOWED_TARGETS.includes(value)) {
+        return undefined;
+      }
+      return value;
+    case 'accessibilityLabel':
+      return value.replace(HTML_METACHAR, '').slice(0, MAX_ACCESSIBILITY_LABEL_LENGTH);
+    default:
+      return value;
+  }
+}
+/** Entry point: tokenises the input string, then parses the token stream into a MarkupNode tree. */
+function parseMarkup(input) {
+  if (!input) {
+    return [];
+  }
+  if (input.length > MAX_INPUT_LENGTH) {
+    return [{
+      type: 'text',
+      content: input
+    }];
+  }
+  const tokens = tokenise(input);
+  const position = {
+    index: 0
+  };
+  return parse(tokens, position).nodes;
+}
+
+export { MAX_ACCESSIBILITY_LABEL_LENGTH, MAX_INPUT_LENGTH, MAX_NESTING_DEPTH, parseMarkup };
+//# sourceMappingURL=parseMarkup.mjs.map

package/build/Markup/utils/parseMarkup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseMarkup.mjs","sources":["../../../src/Markup/utils/parseMarkup.ts"],"sourcesContent":["import { ALLOWED_TARGETS, MAX_NESTING_DEPTH, TAG_ALIASES, TAG_REGEX } from '../constants';\nimport { MarkupNode } from '../Markup.types';\n\nexport { MAX_NESTING_DEPTH };\nexport const MAX_INPUT_LENGTH = 10_000;\nexport const MAX_ACCESSIBILITY_LABEL_LENGTH = 250;\n\nconst OBJECT_PROTOTYPE_KEYS = new Set(Object.getOwnPropertyNames(Object.prototype));\n\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\x00-\\x1f\\x7f-\\x9f]/g;\nconst HTML_METACHAR = /[<>\"']/g;\n\ntype Token =\n  | { type: 'text'; content: string }\n  | { type: 'newline' }\n  | { type: 'open'; tag: string; attrs: string }\n  | { type: 'close'; tag: string };\n\n/**\n * Splits the input string into a flat list of tokens by scanning for known tags.\n * Text between tags is emitted as text/newline tokens. Unrecognised tags are never\n * tokenised — they remain part of the surrounding text content.\n */\nfunction tokenise(input: string): Token[] {\n  const tokens: Token[] = [];\n  let lastIndex = 0;\n\n  TAG_REGEX.lastIndex = 0;\n  let match = TAG_REGEX.exec(input);\n\n  while (match !== null) {\n    if (match.index > lastIndex) {\n      pushTextWithNewlines(tokens, input.slice(lastIndex, match.index));\n    }\n\n    const isClose = match[1] === '/';\n    const tag = match[2];\n    const attrs = match[3] || '';\n\n    if (isClose) {\n      tokens.push({ type: 'close', tag });\n    } else {\n      tokens.push({ type: 'open', tag, attrs });\n    }\n\n    lastIndex = TAG_REGEX.lastIndex;\n    match = TAG_REGEX.exec(input);\n  }\n\n  if (lastIndex < input.length) {\n    pushTextWithNewlines(tokens, input.slice(lastIndex));\n  }\n\n  return tokens;\n}\n\n/** Splits a text fragment on newline characters, interleaving newline tokens between parts. */\nfunction pushTextWithNewlines(tokens: Token[], text: string): void {\n  const parts = text.split('\\n');\n  for (let index = 0; index < parts.length; index += 1) {\n    if (index > 0) {\n      tokens.push({ type: 'newline' });\n    }\n    if (parts[index]) {\n      tokens.push({ type: 'text', content: parts[index] });\n    }\n  }\n}\n\ntype ParseResult = { closed: true; nodes: MarkupNode[] } | { closed: false; nodes: MarkupNode[] };\n\n/**\n * Recursive descent parser that consumes tokens and builds a MarkupNode tree.\n *\n * When `untilTag` is provided, the function collects nodes until it finds a matching\n * close token — returning `{ closed: true }`. If it exhausts all tokens without finding\n * the close, it returns `{ closed: false }` so the caller can fall back to plain text\n * (graceful degradation for malformed input).\n *\n * The shared `position` object acts as a cursor across recursive calls, avoiding the\n * need to slice or copy the token array.\n */\nfunction parse(\n  tokens: Token[],\n  position: { index: number },\n  untilTag?: string,\n  depth = 0,\n): ParseResult {\n  const nodes: MarkupNode[] = [];\n\n  while (position.index < tokens.length) {\n    const token = tokens[position.index];\n\n    if (token.type === 'text') {\n      nodes.push({ type: 'text', content: token.content });\n      position.index += 1;\n    } else if (token.type === 'newline') {\n      nodes.push({ type: 'newline' });\n      position.index += 1;\n    } else if (token.type === 'close') {\n      if (token.tag === untilTag) {\n        position.index += 1;\n        return { closed: true, nodes };\n      }\n      // Mismatched close tag — render as literal text\n      nodes.push({ type: 'text', content: `</${token.tag}>` });\n      position.index += 1;\n    } else if (token.type === 'open') {\n      if (depth >= MAX_NESTING_DEPTH) {\n        nodes.push({ type: 'text', content: `<${token.tag}${token.attrs}>` });\n        position.index += 1;\n      } else {\n        position.index += 1;\n        const result = parse(tokens, position, token.tag, depth + 1);\n\n        if (result.closed) {\n          const node = buildNode(token.tag, token.attrs, result.nodes);\n          nodes.push(node);\n        } else {\n          nodes.push({ type: 'text', content: `<${token.tag}${token.attrs}>` });\n          nodes.push(...result.nodes);\n        }\n      }\n    }\n  }\n\n  if (untilTag) {\n    return { closed: false, nodes };\n  }\n\n  return { closed: true, nodes };\n}\n\n/**\n * Maps a raw tag name to a typed MarkupNode. Resolves aliases first (p→paragraph, a→link),\n * then builds the appropriate node shape. Link nodes carry full attributes; other element\n * nodes extract only accessibilityLabel.\n */\nfunction buildNode(rawTag: string, attrs: string, children: MarkupNode[]): MarkupNode {\n  const tag = TAG_ALIASES[rawTag] || rawTag;\n\n  if (tag === 'link') {\n    return { type: 'link', children, ...parseAttributes(attrs) };\n  }\n\n  if (tag === 'paragraph') {\n    return { type: 'paragraph', children };\n  }\n\n  const { accessibilityLabel } = parseAttributes(attrs);\n\n  return {\n    type: tag as MarkupNode['type'],\n    children,\n    ...(accessibilityLabel && { accessibilityLabel }),\n  } as MarkupNode;\n}\n\nconst ATTR_REGEX = /(?<=\\s)(href|action|target|accessibilityLabel)=(?:\"([^\"]*)\"|'([^']*)')/g;\n\ntype ParsedAttributes = {\n  href?: string;\n  action?: string;\n  target?: string;\n  accessibilityLabel?: string;\n};\n\n/**\n * Extracts allowed attributes from a raw attribute string.\n * Supports both double- and single-quoted values. Any attribute not in the\n * allow-list (href, action, target, accessibilityLabel) is silently discarded.\n * First occurrence wins — duplicates are ignored.\n */\nfunction parseAttributes(attrs: string): ParsedAttributes {\n  const result: ParsedAttributes = {};\n  ATTR_REGEX.lastIndex = 0;\n  let match = ATTR_REGEX.exec(attrs);\n\n  while (match !== null) {\n    const key = match[1] as 'href' | 'action' | 'target' | 'accessibilityLabel';\n    const value = match[2] ?? match[3];\n\n    if (!(key in result)) {\n      const sanitized = sanitizeAttributeValue(key, value);\n      if (sanitized !== undefined) {\n        result[key] = sanitized;\n      }\n    }\n\n    match = ATTR_REGEX.exec(attrs);\n  }\n\n  return result;\n}\n\nfunction sanitizeAttributeValue(\n  key: 'href' | 'action' | 'target' | 'accessibilityLabel',\n  value: string,\n): string | undefined {\n  switch (key) {\n    case 'href':\n      return value.replace(CONTROL_CHARS, '');\n    case 'action':\n      if (OBJECT_PROTOTYPE_KEYS.has(value)) {\n        return undefined;\n      }\n      return value;\n    case 'target':\n      if (!ALLOWED_TARGETS.includes(value)) {\n        return undefined;\n      }\n      return value;\n    case 'accessibilityLabel':\n      return value.replace(HTML_METACHAR, '').slice(0, MAX_ACCESSIBILITY_LABEL_LENGTH);\n    default:\n      return value;\n  }\n}\n\n/** Entry point: tokenises the input string, then parses the token stream into a MarkupNode tree. */\nexport function parseMarkup(input: string): MarkupNode[] {\n  if (!input) {\n    return [];\n  }\n\n  if (input.length > MAX_INPUT_LENGTH) {\n    return [{ type: 'text', content: input }];\n  }\n\n  const tokens = tokenise(input);\n  const position = { index: 0 };\n  return parse(tokens, position).nodes;\n}\n"],"names":["MAX_INPUT_LENGTH","MAX_ACCESSIBILITY_LABEL_LENGTH","OBJECT_PROTOTYPE_KEYS","Set","Object","getOwnPropertyNames","prototype","CONTROL_CHARS","HTML_METACHAR","tokenise","input","tokens","lastIndex","TAG_REGEX","match","exec","index","pushTextWithNewlines","slice","isClose","tag","attrs","push","type","length","text","parts","split","content","parse","position","untilTag","depth","nodes","token","closed","MAX_NESTING_DEPTH","result","node","buildNode","rawTag","children","TAG_ALIASES","parseAttributes","accessibilityLabel","ATTR_REGEX","key","value","sanitized","sanitizeAttributeValue","undefined","replace","has","ALLOWED_TARGETS","includes","parseMarkup"],"mappings":";;AAIO,MAAMA,gBAAgB,GAAG;AACzB,MAAMC,8BAA8B,GAAG;AAE9C,MAAMC,qBAAqB,GAAG,IAAIC,GAAG,CAACC,MAAM,CAACC,mBAAmB,CAACD,MAAM,CAACE,SAAS,CAAC,CAAC;AAEnF;AACA,MAAMC,aAAa,GAAG,uBAAuB;AAC7C,MAAMC,aAAa,GAAG,SAAS;AAQ/B;;;;AAIG;AACH,SAASC,QAAQA,CAACC,KAAa,EAAA;EAC7B,MAAMC,MAAM,GAAY,EAAE;EAC1B,IAAIC,SAAS,GAAG,CAAC;EAEjBC,SAAS,CAACD,SAAS,GAAG,CAAC;AACvB,EAAA,IAAIE,KAAK,GAAGD,SAAS,CAACE,IAAI,CAACL,KAAK,CAAC;EAEjC,OAAOI,KAAK,KAAK,IAAI,EAAE;AACrB,IAAA,IAAIA,KAAK,CAACE,KAAK,GAAGJ,SAAS,EAAE;AAC3BK,MAAAA,oBAAoB,CAACN,MAAM,EAAED,KAAK,CAACQ,KAAK,CAACN,SAAS,EAAEE,KAAK,CAACE,KAAK,CAAC,CAAC;AACnE,IAAA;AAEA,IAAA,MAAMG,OAAO,GAAGL,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;AAChC,IAAA,MAAMM,GAAG,GAAGN,KAAK,CAAC,CAAC,CAAC;AACpB,IAAA,MAAMO,KAAK,GAAGP,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;AAE5B,IAAA,IAAIK,OAAO,EAAE;MACXR,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,OAAO;AAAEH,QAAAA;AAAG,OAAE,CAAC;AACrC,IAAA,CAAC,MAAM;MACLT,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;QAAEH,GAAG;AAAEC,QAAAA;AAAK,OAAE,CAAC;AAC3C,IAAA;IAEAT,SAAS,GAAGC,SAAS,CAACD,SAAS;AAC/BE,IAAAA,KAAK,GAAGD,SAAS,CAACE,IAAI,CAACL,KAAK,CAAC;AAC/B,EAAA;AAEA,EAAA,IAAIE,SAAS,GAAGF,KAAK,CAACc,MAAM,EAAE;IAC5BP,oBAAoB,CAACN,MAAM,EAAED,KAAK,CAACQ,KAAK,CAACN,SAAS,CAAC,CAAC;AACtD,EAAA;AAEA,EAAA,OAAOD,MAAM;AACf;AAEA;AACA,SAASM,oBAAoBA,CAACN,MAAe,EAAEc,IAAY,EAAA;AACzD,EAAA,MAAMC,KAAK,GAAGD,IAAI,CAACE,KAAK,CAAC,IAAI,CAAC;AAC9B,EAAA,KAAK,IAAIX,KAAK,GAAG,CAAC,EAAEA,KAAK,GAAGU,KAAK,CAACF,MAAM,EAAER,KAAK,IAAI,CAAC,EAAE;IACpD,IAAIA,KAAK,GAAG,CAAC,EAAE;MACbL,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE;AAAS,OAAE,CAAC;AAClC,IAAA;AACA,IAAA,IAAIG,KAAK,CAACV,KAAK,CAAC,EAAE;MAChBL,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;QAAEK,OAAO,EAAEF,KAAK,CAACV,KAAK;AAAC,OAAE,CAAC;AACtD,IAAA;AACF,EAAA;AACF;AAIA;;;;;;;;;;AAUG;AACH,SAASa,KAAKA,CACZlB,MAAe,EACfmB,QAA2B,EAC3BC,QAAiB,EACjBC,KAAK,GAAG,CAAC,EAAA;EAET,MAAMC,KAAK,GAAiB,EAAE;AAE9B,EAAA,OAAOH,QAAQ,CAACd,KAAK,GAAGL,MAAM,CAACa,MAAM,EAAE;AACrC,IAAA,MAAMU,KAAK,GAAGvB,MAAM,CAACmB,QAAQ,CAACd,KAAK,CAAC;AAEpC,IAAA,IAAIkB,KAAK,CAACX,IAAI,KAAK,MAAM,EAAE;MACzBU,KAAK,CAACX,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;QAAEK,OAAO,EAAEM,KAAK,CAACN;AAAO,OAAE,CAAC;MACpDE,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,IAAA,CAAC,MAAM,IAAIkB,KAAK,CAACX,IAAI,KAAK,SAAS,EAAE;MACnCU,KAAK,CAACX,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE;AAAS,OAAE,CAAC;MAC/BO,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,IAAA,CAAC,MAAM,IAAIkB,KAAK,CAACX,IAAI,KAAK,OAAO,EAAE;AACjC,MAAA,IAAIW,KAAK,CAACd,GAAG,KAAKW,QAAQ,EAAE;QAC1BD,QAAQ,CAACd,KAAK,IAAI,CAAC;QACnB,OAAO;AAAEmB,UAAAA,MAAM,EAAE,IAAI;AAAEF,UAAAA;SAAO;AAChC,MAAA;AACA;MACAA,KAAK,CAACX,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;AAAEK,QAAAA,OAAO,EAAE,CAAA,EAAA,EAAKM,KAAK,CAACd,GAAG,CAAA,CAAA;AAAG,OAAE,CAAC;MACxDU,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,IAAA,CAAC,MAAM,IAAIkB,KAAK,CAACX,IAAI,KAAK,MAAM,EAAE;MAChC,IAAIS,KAAK,IAAII,iBAAiB,EAAE;QAC9BH,KAAK,CAACX,IAAI,CAAC;AAAEC,UAAAA,IAAI,EAAE,MAAM;UAAEK,OAAO,EAAE,IAAIM,KAAK,CAACd,GAAG,CAAA,EAAGc,KAAK,CAACb,KAAK,CAAA,CAAA;AAAG,SAAE,CAAC;QACrES,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,MAAA,CAAC,MAAM;QACLc,QAAQ,CAACd,KAAK,IAAI,CAAC;AACnB,QAAA,MAAMqB,MAAM,GAAGR,KAAK,CAAClB,MAAM,EAAEmB,QAAQ,EAAEI,KAAK,CAACd,GAAG,EAAEY,KAAK,GAAG,CAAC,CAAC;QAE5D,IAAIK,MAAM,CAACF,MAAM,EAAE;AACjB,UAAA,MAAMG,IAAI,GAAGC,SAAS,CAACL,KAAK,CAACd,GAAG,EAAEc,KAAK,CAACb,KAAK,EAAEgB,MAAM,CAACJ,KAAK,CAAC;AAC5DA,UAAAA,KAAK,CAACX,IAAI,CAACgB,IAAI,CAAC;AAClB,QAAA,CAAC,MAAM;UACLL,KAAK,CAACX,IAAI,CAAC;AAAEC,YAAAA,IAAI,EAAE,MAAM;YAAEK,OAAO,EAAE,IAAIM,KAAK,CAACd,GAAG,CAAA,EAAGc,KAAK,CAACb,KAAK,CAAA,CAAA;AAAG,WAAE,CAAC;AACrEY,UAAAA,KAAK,CAACX,IAAI,CAAC,GAAGe,MAAM,CAACJ,KAAK,CAAC;AAC7B,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA,IAAIF,QAAQ,EAAE;IACZ,OAAO;AAAEI,MAAAA,MAAM,EAAE,KAAK;AAAEF,MAAAA;KAAO;AACjC,EAAA;EAEA,OAAO;AAAEE,IAAAA,MAAM,EAAE,IAAI;AAAEF,IAAAA;GAAO;AAChC;AAEA;;;;AAIG;AACH,SAASM,SAASA,CAACC,MAAc,EAAEnB,KAAa,EAAEoB,QAAsB,EAAA;AACtE,EAAA,MAAMrB,GAAG,GAAGsB,WAAW,CAACF,MAAM,CAAC,IAAIA,MAAM;EAEzC,IAAIpB,GAAG,KAAK,MAAM,EAAE;IAClB,OAAO;AAAEG,MAAAA,IAAI,EAAE,MAAM;MAAEkB,QAAQ;MAAE,GAAGE,eAAe,CAACtB,KAAK;KAAG;AAC9D,EAAA;EAEA,IAAID,GAAG,KAAK,WAAW,EAAE;IACvB,OAAO;AAAEG,MAAAA,IAAI,EAAE,WAAW;AAAEkB,MAAAA;KAAU;AACxC,EAAA;EAEA,MAAM;AAAEG,IAAAA;AAAkB,GAAE,GAAGD,eAAe,CAACtB,KAAK,CAAC;EAErD,OAAO;AACLE,IAAAA,IAAI,EAAEH,GAAyB;IAC/BqB,QAAQ;AACR,IAAA,IAAIG,kBAAkB,IAAI;AAAEA,MAAAA;KAAoB;GACnC;AACjB;AAEA,MAAMC,UAAU,GAAG,yEAAyE;AAS5F;;;;;AAKG;AACH,SAASF,eAAeA,CAACtB,KAAa,EAAA;EACpC,MAAMgB,MAAM,GAAqB,EAAE;EACnCQ,UAAU,CAACjC,SAAS,GAAG,CAAC;AACxB,EAAA,IAAIE,KAAK,GAAG+B,UAAU,CAAC9B,IAAI,CAACM,KAAK,CAAC;EAElC,OAAOP,KAAK,KAAK,IAAI,EAAE;AACrB,IAAA,MAAMgC,GAAG,GAAGhC,KAAK,CAAC,CAAC,CAAwD;IAC3E,MAAMiC,KAAK,GAAGjC,KAAK,CAAC,CAAC,CAAC,IAAIA,KAAK,CAAC,CAAC,CAAC;AAElC,IAAA,IAAI,EAAEgC,GAAG,IAAIT,MAAM,CAAC,EAAE;AACpB,MAAA,MAAMW,SAAS,GAAGC,sBAAsB,CAACH,GAAG,EAAEC,KAAK,CAAC;MACpD,IAAIC,SAAS,KAAKE,SAAS,EAAE;AAC3Bb,QAAAA,MAAM,CAACS,GAAG,CAAC,GAAGE,SAAS;AACzB,MAAA;AACF,IAAA;AAEAlC,IAAAA,KAAK,GAAG+B,UAAU,CAAC9B,IAAI,CAACM,KAAK,CAAC;AAChC,EAAA;AAEA,EAAA,OAAOgB,MAAM;AACf;AAEA,SAASY,sBAAsBA,CAC7BH,GAAwD,EACxDC,KAAa,EAAA;AAEb,EAAA,QAAQD,GAAG;AACT,IAAA,KAAK,MAAM;AACT,MAAA,OAAOC,KAAK,CAACI,OAAO,CAAC5C,aAAa,EAAE,EAAE,CAAC;AACzC,IAAA,KAAK,QAAQ;AACX,MAAA,IAAIL,qBAAqB,CAACkD,GAAG,CAACL,KAAK,CAAC,EAAE;AACpC,QAAA,OAAOG,SAAS;AAClB,MAAA;AACA,MAAA,OAAOH,KAAK;AACd,IAAA,KAAK,QAAQ;AACX,MAAA,IAAI,CAACM,eAAe,CAACC,QAAQ,CAACP,KAAK,CAAC,EAAE;AACpC,QAAA,OAAOG,SAAS;AAClB,MAAA;AACA,MAAA,OAAOH,KAAK;AACd,IAAA,KAAK,oBAAoB;AACvB,MAAA,OAAOA,KAAK,CAACI,OAAO,CAAC3C,aAAa,EAAE,EAAE,CAAC,CAACU,KAAK,CAAC,CAAC,EAAEjB,8BAA8B,CAAC;AAClF,IAAA;AACE,MAAA,OAAO8C,KAAK;AAChB;AACF;AAEA;AACM,SAAUQ,WAAWA,CAAC7C,KAAa,EAAA;EACvC,IAAI,CAACA,KAAK,EAAE;AACV,IAAA,OAAO,EAAE;AACX,EAAA;AAEA,EAAA,IAAIA,KAAK,CAACc,MAAM,GAAGxB,gBAAgB,EAAE;AACnC,IAAA,OAAO,CAAC;AAAEuB,MAAAA,IAAI,EAAE,MAAM;AAAEK,MAAAA,OAAO,EAAElB;AAAK,KAAE,CAAC;AAC3C,EAAA;AAEA,EAAA,MAAMC,MAAM,GAAGF,QAAQ,CAACC,KAAK,CAAC;AAC9B,EAAA,MAAMoB,QAAQ,GAAG;AAAEd,IAAAA,KAAK,EAAE;GAAG;AAC7B,EAAA,OAAOa,KAAK,CAAClB,MAAM,EAAEmB,QAAQ,CAAC,CAACG,KAAK;AACtC;;;;"}

package/build/Markup/utils/sanitise.js

@@ -0,0 +1,114 @@
+'use strict';
+
+var constants = require('../constants.js');
+
+const INVISIBLE_CHARS = /[\u200b\u200c\u200d\ufeff\u00ad\u2060\u180e]/g;
+// eslint-disable-next-line regexp/no-control-character
+const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/;
+const DANGEROUS_HTML_CHARS = /[<>"']/;
+const DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\s*:/i;
+// eslint-disable-next-line regexp/no-useless-non-capturing-group
+const ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;
+const IPV6_BRACKETS = /^\[|\]$/g;
+const NUMERIC_IP = /^[\d.]+$/;
+const HEX_IP = /^0x[0-9a-f]+$/i;
+function isAllowedHref(href) {
+  const cleaned = href.replace(INVISIBLE_CHARS, '');
+  const trimmed = cleaned.trim();
+  if (!trimmed) {
+    return false;
+  }
+  if (CONTROL_CHARS.test(trimmed)) {
+    return false;
+  }
+  if (DANGEROUS_HTML_CHARS.test(trimmed)) {
+    return false;
+  }
+  if (DANGEROUS_SCHEME.test(trimmed)) {
+    return false;
+  }
+  if (ENCODED_COLON_SCHEME.test(trimmed)) {
+    return false;
+  }
+  if (trimmed.startsWith('//')) {
+    return false;
+  }
+  if (trimmed.startsWith('\\')) {
+    return false;
+  }
+  if (trimmed.startsWith('/')) {
+    return trimmed[1] !== '\\';
+  }
+  if (trimmed.startsWith('#')) {
+    return true;
+  }
+  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
+    return false;
+  }
+  try {
+    const url = new URL(trimmed);
+    if (!constants.ALLOWED_PROTOCOLS.includes(url.protocol)) {
+      return false;
+    }
+    if (url.protocol === 'https:') {
+      if (!trimmed.startsWith('https://')) {
+        return false;
+      }
+      if (!url.hostname) {
+        return false;
+      }
+      if (url.username || url.password) {
+        return false;
+      }
+      if (isInternalHost(url.hostname)) {
+        return false;
+      }
+    }
+    if (url.protocol === 'mailto:') {
+      if (url.search) {
+        return false;
+      }
+      if (!url.pathname) {
+        return false;
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+// Synthetic origin used to resolve relative paths via the WHATWG URL parser.
+// If the resolved origin still equals this sentinel, the path stays on-origin.
+const SSR_SENTINEL_ORIGIN = 'https://internal.invalid';
+function isHrefAllowedByMode(href, mode) {
+  switch (mode) {
+    case 'none':
+      return false;
+    case 'all':
+      return true;
+    case 'internal':
+      if (href.startsWith('https://wise.com/')) return true;
+      if (href.startsWith('/')) {
+        try {
+          return new URL(href, SSR_SENTINEL_ORIGIN).origin === SSR_SENTINEL_ORIGIN;
+        } catch {
+          return false;
+        }
+      }
+      return false;
+  }
+}
+function isInternalHost(hostname) {
+  const stripped = hostname.replace(IPV6_BRACKETS, '');
+  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;
+  if (NUMERIC_IP.test(host)) return true;
+  if (HEX_IP.test(host)) return true;
+  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;
+  if (host === 'localhost') return true;
+  if (host.endsWith('.internal')) return true;
+  return false;
+}
+
+exports.isAllowedHref = isAllowedHref;
+exports.isHrefAllowedByMode = isHrefAllowedByMode;
+//# sourceMappingURL=sanitise.js.map

package/build/Markup/utils/sanitise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitise.js","sources":["../../../src/Markup/utils/sanitise.ts"],"sourcesContent":["import { ALLOWED_PROTOCOLS } from '../constants';\n\nconst INVISIBLE_CHARS = /[\\u200b\\u200c\\u200d\\ufeff\\u00ad\\u2060\\u180e]/g;\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst DANGEROUS_HTML_CHARS = /[<>\"']/;\nconst DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\\s*:/i;\n// eslint-disable-next-line regexp/no-useless-non-capturing-group\nconst ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;\nconst IPV6_BRACKETS = /^\\[|\\]$/g;\nconst NUMERIC_IP = /^[\\d.]+$/;\nconst HEX_IP = /^0x[0-9a-f]+$/i;\n\nexport function isAllowedHref(href: string): boolean {\n  const cleaned = href.replace(INVISIBLE_CHARS, '');\n  const trimmed = cleaned.trim();\n\n  if (!trimmed) {\n    return false;\n  }\n\n  if (CONTROL_CHARS.test(trimmed)) {\n    return false;\n  }\n\n  if (DANGEROUS_HTML_CHARS.test(trimmed)) {\n    return false;\n  }\n\n  if (DANGEROUS_SCHEME.test(trimmed)) {\n    return false;\n  }\n\n  if (ENCODED_COLON_SCHEME.test(trimmed)) {\n    return false;\n  }\n\n  if (trimmed.startsWith('//')) {\n    return false;\n  }\n\n  if (trimmed.startsWith('\\\\')) {\n    return false;\n  }\n\n  if (trimmed.startsWith('/')) {\n    return trimmed[1] !== '\\\\';\n  }\n\n  if (trimmed.startsWith('#')) {\n    return true;\n  }\n\n  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {\n    return false;\n  }\n\n  try {\n    const url = new URL(trimmed);\n\n    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n      return false;\n    }\n\n    if (url.protocol === 'https:') {\n      if (!trimmed.startsWith('https://')) {\n        return false;\n      }\n\n      if (!url.hostname) {\n        return false;\n      }\n\n      if (url.username || url.password) {\n        return false;\n      }\n\n      if (isInternalHost(url.hostname)) {\n        return false;\n      }\n    }\n\n    if (url.protocol === 'mailto:') {\n      if (url.search) {\n        return false;\n      }\n\n      if (!url.pathname) {\n        return false;\n      }\n    }\n\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport type AllowLinksMode = 'internal' | 'all' | 'none';\n\n// Synthetic origin used to resolve relative paths via the WHATWG URL parser.\n// If the resolved origin still equals this sentinel, the path stays on-origin.\nconst SSR_SENTINEL_ORIGIN = 'https://internal.invalid';\n\nexport function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean {\n  switch (mode) {\n    case 'none':\n      return false;\n    case 'all':\n      return true;\n    case 'internal':\n      if (href.startsWith('https://wise.com/')) return true;\n      if (href.startsWith('/')) {\n        try {\n          return new URL(href, SSR_SENTINEL_ORIGIN).origin === SSR_SENTINEL_ORIGIN;\n        } catch {\n          return false;\n        }\n      }\n      return false;\n  }\n}\n\nfunction isInternalHost(hostname: string): boolean {\n  const stripped = hostname.replace(IPV6_BRACKETS, '');\n  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;\n  if (NUMERIC_IP.test(host)) return true;\n  if (HEX_IP.test(host)) return true;\n  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;\n  if (host === 'localhost') return true;\n  if (host.endsWith('.internal')) return true;\n  return false;\n}\n"],"names":["INVISIBLE_CHARS","CONTROL_CHARS","DANGEROUS_HTML_CHARS","DANGEROUS_SCHEME","ENCODED_COLON_SCHEME","IPV6_BRACKETS","NUMERIC_IP","HEX_IP","isAllowedHref","href","cleaned","replace","trimmed","trim","test","startsWith","url","URL","ALLOWED_PROTOCOLS","includes","protocol","hostname","username","password","isInternalHost","search","pathname","SSR_SENTINEL_ORIGIN","isHrefAllowedByMode","mode","origin","stripped","host","endsWith","slice"],"mappings":";;;;AAEA,MAAMA,eAAe,GAAG,+CAA+C;AACvE;AACA,MAAMC,aAAa,GAAG,8BAA8B;AACpD,MAAMC,oBAAoB,GAAG,QAAQ;AACrC,MAAMC,gBAAgB,GAAG,4CAA4C;AACrE;AACA,MAAMC,oBAAoB,GAAG,+CAA+C;AAC5E,MAAMC,aAAa,GAAG,UAAU;AAChC,MAAMC,UAAU,GAAG,UAAU;AAC7B,MAAMC,MAAM,GAAG,gBAAgB;AAEzB,SAAUC,aAAaA,CAACC,IAAY,EAAA;EACxC,MAAMC,OAAO,GAAGD,IAAI,CAACE,OAAO,CAACX,eAAe,EAAE,EAAE,CAAC;AACjD,EAAA,MAAMY,OAAO,GAAGF,OAAO,CAACG,IAAI,EAAE;EAE9B,IAAI,CAACD,OAAO,EAAE;AACZ,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIX,aAAa,CAACa,IAAI,CAACF,OAAO,CAAC,EAAE;AAC/B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIV,oBAAoB,CAACY,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIT,gBAAgB,CAACW,IAAI,CAACF,OAAO,CAAC,EAAE;AAClC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIR,oBAAoB,CAACU,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAOH,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;AAC5B,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAO,IAAI;AACb,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,IAAIH,OAAO,CAACG,UAAU,CAAC,KAAK,CAAC,EAAE;AACzD,IAAA,OAAO,KAAK;AACd,EAAA;EAEA,IAAI;AACF,IAAA,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACL,OAAO,CAAC;IAE5B,IAAI,CAACM,2BAAiB,CAACC,QAAQ,CAACH,GAAG,CAACI,QAAQ,CAAC,EAAE;AAC7C,MAAA,OAAO,KAAK;AACd,IAAA;AAEA,IAAA,IAAIJ,GAAG,CAACI,QAAQ,KAAK,QAAQ,EAAE;AAC7B,MAAA,IAAI,CAACR,OAAO,CAACG,UAAU,CAAC,UAAU,CAAC,EAAE;AACnC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACC,GAAG,CAACK,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIL,GAAG,CAACM,QAAQ,IAAIN,GAAG,CAACO,QAAQ,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIC,cAAc,CAACR,GAAG,CAACK,QAAQ,CAAC,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,IAAIL,GAAG,CAACI,QAAQ,KAAK,SAAS,EAAE;MAC9B,IAAIJ,GAAG,CAACS,MAAM,EAAE;AACd,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACT,GAAG,CAACU,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,OAAO,IAAI;AACb,EAAA,CAAC,CAAC,MAAM;AACN,IAAA,OAAO,KAAK;AACd,EAAA;AACF;AAIA;AACA;AACA,MAAMC,mBAAmB,GAAG,0BAA0B;AAEhD,SAAUC,mBAAmBA,CAACnB,IAAY,EAAEoB,IAAoB,EAAA;AACpE,EAAA,QAAQA,IAAI;AACV,IAAA,KAAK,MAAM;AACT,MAAA,OAAO,KAAK;AACd,IAAA,KAAK,KAAK;AACR,MAAA,OAAO,IAAI;AACb,IAAA,KAAK,UAAU;MACb,IAAIpB,IAAI,CAACM,UAAU,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACrD,MAAA,IAAIN,IAAI,CAACM,UAAU,CAAC,GAAG,CAAC,EAAE;QACxB,IAAI;UACF,OAAO,IAAIE,GAAG,CAACR,IAAI,EAAEkB,mBAAmB,CAAC,CAACG,MAAM,KAAKH,mBAAmB;AAC1E,QAAA,CAAC,CAAC,MAAM;AACN,UAAA,OAAO,KAAK;AACd,QAAA;AACF,MAAA;AACA,MAAA,OAAO,KAAK;AAChB;AACF;AAEA,SAASH,cAAcA,CAACH,QAAgB,EAAA;EACtC,MAAMU,QAAQ,GAAGV,QAAQ,CAACV,OAAO,CAACN,aAAa,EAAE,EAAE,CAAC;AACpD,EAAA,MAAM2B,IAAI,GAAGD,QAAQ,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAGF,QAAQ,CAACG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAGH,QAAQ;EACtE,IAAIzB,UAAU,CAACQ,IAAI,CAACkB,IAAI,CAAC,EAAE,OAAO,IAAI;EACtC,IAAIzB,MAAM,CAACO,IAAI,CAACkB,IAAI,CAAC,EAAE,OAAO,IAAI;EAClC,IAAIA,IAAI,KAAK,KAAK,IAAIA,IAAI,KAAK,iBAAiB,EAAE,OAAO,IAAI;AAC7D,EAAA,IAAIA,IAAI,KAAK,WAAW,EAAE,OAAO,IAAI;EACrC,IAAIA,IAAI,CAACC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAA,OAAO,KAAK;AACd;;;;;"}

package/build/Markup/utils/sanitise.mjs

@@ -0,0 +1,111 @@
+import { ALLOWED_PROTOCOLS } from '../constants.mjs';
+
+const INVISIBLE_CHARS = /[\u200b\u200c\u200d\ufeff\u00ad\u2060\u180e]/g;
+// eslint-disable-next-line regexp/no-control-character
+const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/;
+const DANGEROUS_HTML_CHARS = /[<>"']/;
+const DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\s*:/i;
+// eslint-disable-next-line regexp/no-useless-non-capturing-group
+const ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;
+const IPV6_BRACKETS = /^\[|\]$/g;
+const NUMERIC_IP = /^[\d.]+$/;
+const HEX_IP = /^0x[0-9a-f]+$/i;
+function isAllowedHref(href) {
+  const cleaned = href.replace(INVISIBLE_CHARS, '');
+  const trimmed = cleaned.trim();
+  if (!trimmed) {
+    return false;
+  }
+  if (CONTROL_CHARS.test(trimmed)) {
+    return false;
+  }
+  if (DANGEROUS_HTML_CHARS.test(trimmed)) {
+    return false;
+  }
+  if (DANGEROUS_SCHEME.test(trimmed)) {
+    return false;
+  }
+  if (ENCODED_COLON_SCHEME.test(trimmed)) {
+    return false;
+  }
+  if (trimmed.startsWith('//')) {
+    return false;
+  }
+  if (trimmed.startsWith('\\')) {
+    return false;
+  }
+  if (trimmed.startsWith('/')) {
+    return trimmed[1] !== '\\';
+  }
+  if (trimmed.startsWith('#')) {
+    return true;
+  }
+  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
+    return false;
+  }
+  try {
+    const url = new URL(trimmed);
+    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
+      return false;
+    }
+    if (url.protocol === 'https:') {
+      if (!trimmed.startsWith('https://')) {
+        return false;
+      }
+      if (!url.hostname) {
+        return false;
+      }
+      if (url.username || url.password) {
+        return false;
+      }
+      if (isInternalHost(url.hostname)) {
+        return false;
+      }
+    }
+    if (url.protocol === 'mailto:') {
+      if (url.search) {
+        return false;
+      }
+      if (!url.pathname) {
+        return false;
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+// Synthetic origin used to resolve relative paths via the WHATWG URL parser.
+// If the resolved origin still equals this sentinel, the path stays on-origin.
+const SSR_SENTINEL_ORIGIN = 'https://internal.invalid';
+function isHrefAllowedByMode(href, mode) {
+  switch (mode) {
+    case 'none':
+      return false;
+    case 'all':
+      return true;
+    case 'internal':
+      if (href.startsWith('https://wise.com/')) return true;
+      if (href.startsWith('/')) {
+        try {
+          return new URL(href, SSR_SENTINEL_ORIGIN).origin === SSR_SENTINEL_ORIGIN;
+        } catch {
+          return false;
+        }
+      }
+      return false;
+  }
+}
+function isInternalHost(hostname) {
+  const stripped = hostname.replace(IPV6_BRACKETS, '');
+  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;
+  if (NUMERIC_IP.test(host)) return true;
+  if (HEX_IP.test(host)) return true;
+  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;
+  if (host === 'localhost') return true;
+  if (host.endsWith('.internal')) return true;
+  return false;
+}
+
+export { isAllowedHref, isHrefAllowedByMode };
+//# sourceMappingURL=sanitise.mjs.map

package/build/Markup/utils/sanitise.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitise.mjs","sources":["../../../src/Markup/utils/sanitise.ts"],"sourcesContent":["import { ALLOWED_PROTOCOLS } from '../constants';\n\nconst INVISIBLE_CHARS = /[\\u200b\\u200c\\u200d\\ufeff\\u00ad\\u2060\\u180e]/g;\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst DANGEROUS_HTML_CHARS = /[<>\"']/;\nconst DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\\s*:/i;\n// eslint-disable-next-line regexp/no-useless-non-capturing-group\nconst ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;\nconst IPV6_BRACKETS = /^\\[|\\]$/g;\nconst NUMERIC_IP = /^[\\d.]+$/;\nconst HEX_IP = /^0x[0-9a-f]+$/i;\n\nexport function isAllowedHref(href: string): boolean {\n  const cleaned = href.replace(INVISIBLE_CHARS, '');\n  const trimmed = cleaned.trim();\n\n  if (!trimmed) {\n    return false;\n  }\n\n  if (CONTROL_CHARS.test(trimmed)) {\n    return false;\n  }\n\n  if (DANGEROUS_HTML_CHARS.test(trimmed)) {\n    return false;\n  }\n\n  if (DANGEROUS_SCHEME.test(trimmed)) {\n    return false;\n  }\n\n  if (ENCODED_COLON_SCHEME.test(trimmed)) {\n    return false;\n  }\n\n  if (trimmed.startsWith('//')) {\n    return false;\n  }\n\n  if (trimmed.startsWith('\\\\')) {\n    return false;\n  }\n\n  if (trimmed.startsWith('/')) {\n    return trimmed[1] !== '\\\\';\n  }\n\n  if (trimmed.startsWith('#')) {\n    return true;\n  }\n\n  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {\n    return false;\n  }\n\n  try {\n    const url = new URL(trimmed);\n\n    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n      return false;\n    }\n\n    if (url.protocol === 'https:') {\n      if (!trimmed.startsWith('https://')) {\n        return false;\n      }\n\n      if (!url.hostname) {\n        return false;\n      }\n\n      if (url.username || url.password) {\n        return false;\n      }\n\n      if (isInternalHost(url.hostname)) {\n        return false;\n      }\n    }\n\n    if (url.protocol === 'mailto:') {\n      if (url.search) {\n        return false;\n      }\n\n      if (!url.pathname) {\n        return false;\n      }\n    }\n\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport type AllowLinksMode = 'internal' | 'all' | 'none';\n\n// Synthetic origin used to resolve relative paths via the WHATWG URL parser.\n// If the resolved origin still equals this sentinel, the path stays on-origin.\nconst SSR_SENTINEL_ORIGIN = 'https://internal.invalid';\n\nexport function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean {\n  switch (mode) {\n    case 'none':\n      return false;\n    case 'all':\n      return true;\n    case 'internal':\n      if (href.startsWith('https://wise.com/')) return true;\n      if (href.startsWith('/')) {\n        try {\n          return new URL(href, SSR_SENTINEL_ORIGIN).origin === SSR_SENTINEL_ORIGIN;\n        } catch {\n          return false;\n        }\n      }\n      return false;\n  }\n}\n\nfunction isInternalHost(hostname: string): boolean {\n  const stripped = hostname.replace(IPV6_BRACKETS, '');\n  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;\n  if (NUMERIC_IP.test(host)) return true;\n  if (HEX_IP.test(host)) return true;\n  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;\n  if (host === 'localhost') return true;\n  if (host.endsWith('.internal')) return true;\n  return false;\n}\n"],"names":["INVISIBLE_CHARS","CONTROL_CHARS","DANGEROUS_HTML_CHARS","DANGEROUS_SCHEME","ENCODED_COLON_SCHEME","IPV6_BRACKETS","NUMERIC_IP","HEX_IP","isAllowedHref","href","cleaned","replace","trimmed","trim","test","startsWith","url","URL","ALLOWED_PROTOCOLS","includes","protocol","hostname","username","password","isInternalHost","search","pathname","SSR_SENTINEL_ORIGIN","isHrefAllowedByMode","mode","origin","stripped","host","endsWith","slice"],"mappings":";;AAEA,MAAMA,eAAe,GAAG,+CAA+C;AACvE;AACA,MAAMC,aAAa,GAAG,8BAA8B;AACpD,MAAMC,oBAAoB,GAAG,QAAQ;AACrC,MAAMC,gBAAgB,GAAG,4CAA4C;AACrE;AACA,MAAMC,oBAAoB,GAAG,+CAA+C;AAC5E,MAAMC,aAAa,GAAG,UAAU;AAChC,MAAMC,UAAU,GAAG,UAAU;AAC7B,MAAMC,MAAM,GAAG,gBAAgB;AAEzB,SAAUC,aAAaA,CAACC,IAAY,EAAA;EACxC,MAAMC,OAAO,GAAGD,IAAI,CAACE,OAAO,CAACX,eAAe,EAAE,EAAE,CAAC;AACjD,EAAA,MAAMY,OAAO,GAAGF,OAAO,CAACG,IAAI,EAAE;EAE9B,IAAI,CAACD,OAAO,EAAE;AACZ,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIX,aAAa,CAACa,IAAI,CAACF,OAAO,CAAC,EAAE;AAC/B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIV,oBAAoB,CAACY,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIT,gBAAgB,CAACW,IAAI,CAACF,OAAO,CAAC,EAAE;AAClC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIR,oBAAoB,CAACU,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAOH,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;AAC5B,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAO,IAAI;AACb,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,IAAIH,OAAO,CAACG,UAAU,CAAC,KAAK,CAAC,EAAE;AACzD,IAAA,OAAO,KAAK;AACd,EAAA;EAEA,IAAI;AACF,IAAA,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACL,OAAO,CAAC;IAE5B,IAAI,CAACM,iBAAiB,CAACC,QAAQ,CAACH,GAAG,CAACI,QAAQ,CAAC,EAAE;AAC7C,MAAA,OAAO,KAAK;AACd,IAAA;AAEA,IAAA,IAAIJ,GAAG,CAACI,QAAQ,KAAK,QAAQ,EAAE;AAC7B,MAAA,IAAI,CAACR,OAAO,CAACG,UAAU,CAAC,UAAU,CAAC,EAAE;AACnC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACC,GAAG,CAACK,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIL,GAAG,CAACM,QAAQ,IAAIN,GAAG,CAACO,QAAQ,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIC,cAAc,CAACR,GAAG,CAACK,QAAQ,CAAC,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,IAAIL,GAAG,CAACI,QAAQ,KAAK,SAAS,EAAE;MAC9B,IAAIJ,GAAG,CAACS,MAAM,EAAE;AACd,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACT,GAAG,CAACU,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,OAAO,IAAI;AACb,EAAA,CAAC,CAAC,MAAM;AACN,IAAA,OAAO,KAAK;AACd,EAAA;AACF;AAIA;AACA;AACA,MAAMC,mBAAmB,GAAG,0BAA0B;AAEhD,SAAUC,mBAAmBA,CAACnB,IAAY,EAAEoB,IAAoB,EAAA;AACpE,EAAA,QAAQA,IAAI;AACV,IAAA,KAAK,MAAM;AACT,MAAA,OAAO,KAAK;AACd,IAAA,KAAK,KAAK;AACR,MAAA,OAAO,IAAI;AACb,IAAA,KAAK,UAAU;MACb,IAAIpB,IAAI,CAACM,UAAU,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACrD,MAAA,IAAIN,IAAI,CAACM,UAAU,CAAC,GAAG,CAAC,EAAE;QACxB,IAAI;UACF,OAAO,IAAIE,GAAG,CAACR,IAAI,EAAEkB,mBAAmB,CAAC,CAACG,MAAM,KAAKH,mBAAmB;AAC1E,QAAA,CAAC,CAAC,MAAM;AACN,UAAA,OAAO,KAAK;AACd,QAAA;AACF,MAAA;AACA,MAAA,OAAO,KAAK;AAChB;AACF;AAEA,SAASH,cAAcA,CAACH,QAAgB,EAAA;EACtC,MAAMU,QAAQ,GAAGV,QAAQ,CAACV,OAAO,CAACN,aAAa,EAAE,EAAE,CAAC;AACpD,EAAA,MAAM2B,IAAI,GAAGD,QAAQ,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAGF,QAAQ,CAACG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAGH,QAAQ;EACtE,IAAIzB,UAAU,CAACQ,IAAI,CAACkB,IAAI,CAAC,EAAE,OAAO,IAAI;EACtC,IAAIzB,MAAM,CAACO,IAAI,CAACkB,IAAI,CAAC,EAAE,OAAO,IAAI;EAClC,IAAIA,IAAI,KAAK,KAAK,IAAIA,IAAI,KAAK,iBAAiB,EAAE,OAAO,IAAI;AAC7D,EAAA,IAAIA,IAAI,KAAK,WAAW,EAAE,OAAO,IAAI;EACrC,IAAIA,IAAI,CAACC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAA,OAAO,KAAK;AACd;;;;"}

package/build/index.js

@@ -76,6 +76,7 @@ var LegacyListItem = require('./_deprecated/LegacyListItem/LegacyListItem.js');
 var Loader = require('./Loader/Loader.js');
 var Logo = require('./Logo/Logo.js');
 var Markdown = require('./Markdown/Markdown.js');
+var Markup = require('./Markup/Markup.js');
 var Modal = require('./Modal/Modal.js');
 var Money = require('./Money/Money.js');
 var MoneyInput = require('./MoneyInput/MoneyInput.js');
@@ -244,6 +245,7 @@ Object.defineProperty(exports, "LogoType", {
 	get: function () { return Logo.LogoType; }
 });
 exports.Markdown = Markdown.default;
+exports.Markup = Markup.Markup;
 exports.Modal = Modal.default;
 exports.Money = Money.default;
 exports.MoneyInput = MoneyInput.default;

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/index.mjs

@@ -74,6 +74,7 @@ export { default as LegacyListItem } from './_deprecated/LegacyListItem/LegacyLi
 export { default as Loader } from './Loader/Loader.mjs';
 export { default as Logo, LogoType } from './Logo/Logo.mjs';
 export { default as Markdown } from './Markdown/Markdown.mjs';
+export { Markup } from './Markup/Markup.mjs';
 export { default as Modal } from './Modal/Modal.mjs';
 export { default as Money } from './Money/Money.mjs';
 export { default as MoneyInput } from './MoneyInput/MoneyInput.mjs';

package/build/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/main.css

@@ -30887,6 +30887,41 @@ button.np-link {
   height: var(--wds-logo-height);
 }
 
+.wds-markup-emphasis {
+  font-weight: 600;
+  font-weight: var(--font-weight-semi-bold);
+  font-style: normal;
+}
+
+.wds-markup-emphasis--important {
+  color: #37517e;
+  color: var(--color-content-primary);
+}
+
+.wds-markup-emphasis--positive {
+  color: #008026;
+  color: var(--color-content-positive);
+}
+
+.wds-markup-emphasis--negative {
+  color: #cf2929;
+  color: var(--color-content-negative);
+}
+
+.wds-markup-strong {
+  font-weight: 600;
+  font-weight: var(--font-weight-semi-bold);
+}
+
+.wds-markup-strikethrough {
+  -webkit-text-decoration: line-through;
+  text-decoration: line-through;
+}
+
+.wds-markup-paragraph {
+  margin: 0;
+}
+
 .tw-modal--scrollable {
   max-height: 100%;
   /* mobile viewport bug fix */

package/build/styles/Markup/Markup.css

@@ -0,0 +1,28 @@
+.wds-markup-emphasis {
+  font-weight: 600;
+  font-weight: var(--font-weight-semi-bold);
+  font-style: normal;
+}
+.wds-markup-emphasis--important {
+  color: #37517e;
+  color: var(--color-content-primary);
+}
+.wds-markup-emphasis--positive {
+  color: #008026;
+  color: var(--color-content-positive);
+}
+.wds-markup-emphasis--negative {
+  color: #cf2929;
+  color: var(--color-content-negative);
+}
+.wds-markup-strong {
+  font-weight: 600;
+  font-weight: var(--font-weight-semi-bold);
+}
+.wds-markup-strikethrough {
+  -webkit-text-decoration: line-through;
+  text-decoration: line-through;
+}
+.wds-markup-paragraph {
+  margin: 0;
+}