@usegraft/mdx-safety 0.2.0 → 1.0.0-beta.0

package/README.md

@@ -38,4 +38,4 @@ This refuses _executable_ constructs. It is not a general HTML sanitiser. If you
 
 ---
 
-MIT. [Repository](https://github.com/AndersonDesign1/graft) · [Changelog](https://github.com/AndersonDesign1/graft/blob/feat/core/packages/mdx-safety/CHANGELOG.md) · [Security policy](https://github.com/AndersonDesign1/graft/blob/feat/core/SECURITY.md)
+MIT. [Repository](https://github.com/AndersonDesign1/graft) · [Changelog](https://github.com/AndersonDesign1/graft/blob/main/packages/mdx-safety/CHANGELOG.md) · [Security policy](https://github.com/AndersonDesign1/graft/blob/main/SECURITY.md)

package/dist/index.js

@@ -91,9 +91,20 @@ function findExecutableMdx(source) {
   return found;
 }
 function assertSafeMdx(source, options = {}) {
-  const found = findExecutableMdx(source);
-  if (found.length === 0) return;
   const where = options.label ? ` in ${options.label}` : "";
+  let found;
+  try {
+    found = findExecutableMdx(source);
+  } catch (error) {
+    if (!(error instanceof UncheckableMdxError)) throw error;
+    throw new GraftError({
+      code: "INPUT_VALIDATION_FAILED",
+      message: `MDX could not be parsed${where}, so it cannot be checked for executable source \u2014 ${error.message}`,
+      fix: "Fix the MDX syntax and retry. Source the checker cannot read is refused rather than accepted, because the renderer's parser is not this one and the gap between them is exactly where executable source would sit.",
+      details: { label: options.label, reason: error.message }
+    });
+  }
+  if (found.length === 0) return;
   const listed = found.slice(0, 5).map((node) => {
     const line = node.line === void 0 ? "" : ` (line ${node.line})`;
     const snippet = node.snippet === void 0 ? "" : `: ${node.snippet}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usegraft/mdx-safety",
-  "version": "0.2.0",
+  "version": "1.0.0-beta.0",
   "description": "Refuse executable MDX before it is stored or rendered. MDX is code, and rendering evaluates it on the server.",
   "keywords": [
     "agent",
@@ -36,7 +36,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@usegraft/contracts": "0.2.0",
+    "@usegraft/contracts": "1.0.0-beta.0",
     "remark-gfm": "^4.0.1",
     "remark-mdx": "^3.1.1",
     "remark-parse": "^11.0.0",