anentrypoint-design 0.0.337 → 0.0.339

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anentrypoint-design",
-  "version": "0.0.337",
+  "version": "0.0.339",
   "description": "247420 design system SDK — webjsx + modified ripple-ui, single-file ESM bundle for reproducible use of the AnEntrypoint design.",
   "type": "module",
   "main": "./dist/247420.js",

package/src/components/content.js

@@ -107,13 +107,20 @@ export function Row({ code, rank, title, sub, meta, active, state = 'default', o
     const railWord = rail === 'flame' ? 'error' : rail === 'purple' ? 'subagent' : null;
     // `detail` renders as a sibling block AFTER the title/meta children (its own
     // line via flex-basis:100% in .ds-row-detail), not inside the title span.
+    // The same `highlight` search term that marks matches in the collapsed
+    // title previously stopped applying the moment a row expanded - the
+    // expanded body (often the ONLY place a match beyond the 220-char title
+    // window is actually visible) rendered as plain unmarked text.
+    const detailNode = (highlight && typeof detail === 'string')
+        ? h('span', {}, ...[].concat(highlightTitle(detail, highlight)))
+        : detail;
     return h(isLink ? 'a' : 'div', props,
         railWord ? h('span', { class: 'sr-only' }, railWord) : null,
         leading != null ? leading : (codeVal != null ? h('span', { class: 'code' }, codeVal) : null),
         h('span', { class: 'title', title: typeof title === 'string' ? title : undefined }, titleNode, sub ? h('span', { class: 'sub', title: typeof sub === 'string' ? sub : undefined }, sub) : null),
         trailing != null ? trailing : (meta != null ? h('span', { class: 'meta' }, meta) : null),
         actionRow,
-        detail != null ? h('pre', { class: 'ds-row-detail' }, detail) : null);
+        detail != null ? h('pre', { class: 'ds-row-detail' }, detailNode) : null);
 }
 
 export function RowLink({ code, title, sub, meta, href = '#', key, target }) {

package/src/page-html.js

@@ -37,12 +37,26 @@ export function slugify(s) {
         .replace(/\s+/g, '-');
 }
 
+// Raw-HTML passthrough block, opt-in via ```html fences. Distinct from a
+// plain ``` code fence (which still escapes+<pre>-wraps its contents) — this
+// is for SSR call sites that are trusted, repo-authored content (a theme.mjs
+// page body sourced from the project's own YAML, never end-user input) and
+// need to emit real markup (e.g. an <iframe> demo embed) that must NOT be
+// escaped. There is no sanitization here by design: the caller owns trust.
+// A consumer rendering untrusted content must not route it through this
+// path — use markdown.js's DOMPurify-backed renderMarkdown for that instead.
 export function renderMarkdown(md) {
     const lines = String(md || '').split('\n');
     const out = [];
-    let inCode = false, inList = false;
+    let inCode = false, inList = false, inRawHtml = false;
     for (const line of lines) {
-        if (line.startsWith('```')) { if (inCode) { out.push('</pre>'); inCode = false; } else { out.push('<pre>'); inCode = true; } continue; }
+        if (line.trim() === '```html') { if (!inCode) { inRawHtml = true; continue; } }
+        if (line.startsWith('```')) {
+            if (inRawHtml) { inRawHtml = false; continue; }
+            if (inCode) { out.push('</pre>'); inCode = false; } else { out.push('<pre>'); inCode = true; }
+            continue;
+        }
+        if (inRawHtml) { out.push(line); continue; }
         if (inCode) { out.push(escape(line)); continue; }
         if (line.startsWith('# ')) { const t = line.slice(2); out.push(`<h1 id="${slugify(t)}">${escape(t)}</h1>`); }
         else if (line.startsWith('## ')) { const t = line.slice(3); out.push(`<h2 id="${slugify(t)}">${escape(t)}</h2>`); }