sourcey 3.5.10 → 3.6.1

package/dist/utils/code-samples.js

@@ -4,11 +4,11 @@ import { generateExample } from "./example-generator.js";
 // ---------------------------------------------------------------------------
 const generators = {
     curl({ url, method, contentType, body }) {
-        const parts = [`curl -X ${method} '${url}'`];
+        const parts = [`curl -X ${method} ${shellSingleQuoted(url)}`];
         if (contentType)
-            parts.push(`  -H 'Content-Type: ${contentType}'`);
+            parts.push(`  -H ${shellSingleQuoted(`Content-Type: ${contentType}`)}`);
         if (body)
-            parts.push(`  -d '${indent(body, 2)}'`);
+            parts.push(`  -d ${shellSingleQuoted(indent(body, 2))}`);
         return { lang: "bash", label: "cURL", source: parts.join(" \\\n") };
     },
     javascript({ url, method, contentType, body }) {
@@ -51,7 +51,7 @@ const generators = {
         return { lang: "python", label: "Python", source: lines.join("\n") };
     },
     go({ url, method, body }) {
-        const lines = ["package main", "", "import (", `  "fmt"`, `  "io"`, `  "net/http"`,];
+        const lines = ["package main", "", "import (", `  "fmt"`, `  "io"`, `  "net/http"`];
         if (body)
             lines.push(`  "strings"`);
         lines.push(")", "");
@@ -63,7 +63,8 @@ const generators = {
         else {
             lines.push(`  req, _ := http.NewRequest("${method}", "${url}", nil)`);
         }
-        lines.push(`  req.Header.Set("Content-Type", "application/json")`);
+        if (body)
+            lines.push(`  req.Header.Set("Content-Type", "application/json")`);
         lines.push(`  resp, _ := http.DefaultClient.Do(req)`);
         lines.push(`  defer resp.Body.Close()`);
         lines.push(`  data, _ := io.ReadAll(resp.Body)`);
@@ -76,21 +77,23 @@ const generators = {
             `require 'net/http'`,
             `require 'json'`,
             ``,
-            `uri = URI('${url}')`,
+            `uri = URI('${rubySingleQuoted(url)}')`,
         ];
         const methodClass = rubyShortcutMethod(method);
         if (methodClass) {
             lines.push(`request = Net::HTTP::${methodClass}.new(uri)`);
             if (contentType)
-                lines.push(`request['Content-Type'] = '${contentType}'`);
+                lines.push(`request['Content-Type'] = '${rubySingleQuoted(contentType)}'`);
             if (body)
-                lines.push(`request.body = '${indent(body, 2)}'`);
+                lines.push(`request.body = '${rubySingleQuoted(indent(body, 2))}'`);
         }
         else {
-            const headers = contentType ? `{ 'Content-Type' => '${contentType}' }` : "{}";
+            const headers = contentType
+                ? `{ 'Content-Type' => '${rubySingleQuoted(contentType)}' }`
+                : "{}";
             lines.push(`request = Net::HTTPGenericRequest.new('${method}', ${body ? "true" : "false"}, true, uri.request_uri, ${headers})`);
             if (body)
-                lines.push(`request.body = '${indent(body, 2)}'`);
+                lines.push(`request.body = '${rubySingleQuoted(indent(body, 2))}'`);
         }
         lines.push(``, `response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }`);
         lines.push(`data = JSON.parse(response.body)`);
@@ -121,16 +124,16 @@ const generators = {
         return { lang: "java", label: "Java", source: lines.join("\n") };
     },
     php({ url, method, contentType, body }) {
-        const lines = [`<?php`, `$ch = curl_init('${url}');`];
+        const lines = [`<?php`, `$ch = curl_init('${phpSingleQuoted(url)}');`];
         lines.push(`curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);`);
         if (method !== "GET") {
-            lines.push(`curl_setopt($ch, CURLOPT_CUSTOMREQUEST, '${method}');`);
+            lines.push(`curl_setopt($ch, CURLOPT_CUSTOMREQUEST, '${phpSingleQuoted(method)}');`);
         }
         if (contentType) {
-            lines.push(`curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: ${contentType}']);`);
+            lines.push(`curl_setopt($ch, CURLOPT_HTTPHEADER, ['${phpSingleQuoted(`Content-Type: ${contentType}`)}']);`);
         }
         if (body) {
-            lines.push(`curl_setopt($ch, CURLOPT_POSTFIELDS, '${indent(body, 2)}');`);
+            lines.push(`curl_setopt($ch, CURLOPT_POSTFIELDS, '${phpSingleQuoted(indent(body, 2))}');`);
         }
         lines.push(``, `$response = curl_exec($ch);`, `curl_close($ch);`);
         lines.push(`$data = json_decode($response, true);`);
@@ -165,10 +168,7 @@ const generators = {
         return { lang: "rust", label: "Rust", source: lines.join("\n") };
     },
     csharp({ url, method, body }) {
-        const lines = [
-            `using var client = new HttpClient();`,
-            ``,
-        ];
+        const lines = [`using var client = new HttpClient();`, ``];
         const httpMethod = csharpShortcutMethod(method)
             ? `HttpMethod.${method[0] + method.slice(1).toLowerCase()}`
             : `new HttpMethod("${method}")`;
@@ -185,6 +185,7 @@ const generators = {
 };
 /** Default languages when none configured. */
 export const DEFAULT_CODE_SAMPLE_LANGS = ["curl", "javascript", "python"];
+export const SUPPORTED_CODE_SAMPLE_LANGS = Object.freeze(Object.keys(generators));
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -203,14 +204,12 @@ export function generateCodeSamples(op, serverUrl, langs = DEFAULT_CODE_SAMPLE_L
     const method = op.method.toUpperCase();
     const hasBody = !!op.requestBody;
     const contentType = hasBody
-        ? Object.keys(op.requestBody.content)[0] ?? "application/json"
+        ? (Object.keys(op.requestBody.content)[0] ?? "application/json")
         : undefined;
     const bodyExample = hasBody ? getRequestBodyExample(op) : undefined;
     const body = bodyExample ? JSON.stringify(bodyExample, null, 2) : undefined;
     const req = { url, method, contentType, body };
-    return langs
-        .map((lang) => generators[lang]?.(req))
-        .filter((s) => !!s);
+    return langs.map((lang) => generators[lang]?.(req)).filter((s) => !!s);
 }
 // ---------------------------------------------------------------------------
 // Helpers
@@ -259,6 +258,15 @@ function rustShortcutMethod(method) {
 function csharpShortcutMethod(method) {
     return ["GET", "POST", "PUT", "DELETE", "PATCH"].includes(method);
 }
+function shellSingleQuoted(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function rubySingleQuoted(value) {
+    return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+function phpSingleQuoted(value) {
+    return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
 /** Indent all lines of a multi-line string except the first. */
 function indent(str, spaces) {
     const pad = " ".repeat(spaces);

package/dist/utils/html.d.ts

@@ -0,0 +1,10 @@
+export interface SafeUrlOptions {
+    allowedProtocols?: readonly string[];
+    allowRelative?: boolean;
+    allowAnchor?: boolean;
+}
+export declare function escapeHtml(value: string): string;
+export declare function escapeAttr(value: string): string;
+export declare function safeUrl(input: string, options?: SafeUrlOptions): string | null;
+export declare function sanitizeRenderedHtml(input: string): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/utils/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/utils/html.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,MAAM,GAAG,IAAI,CAkBlF;AAUD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA2G1D"}

package/dist/utils/html.js

@@ -0,0 +1,152 @@
+import sanitizeHtml from "sanitize-html";
+const BASE_URL = "https://sourcey.invalid/";
+const EXPLICIT_SCHEME_RE = /^[a-z][a-z\d+.-]*:/i;
+export function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+export function escapeAttr(value) {
+    return escapeHtml(value);
+}
+export function safeUrl(input, options = {}) {
+    const allowedProtocols = options.allowedProtocols ?? ["http:", "https:", "mailto:"];
+    const allowRelative = options.allowRelative ?? true;
+    const allowAnchor = options.allowAnchor ?? true;
+    const value = input.trim();
+    if (!value || hasRawControlOrSpace(value))
+        return null;
+    if (value.startsWith("#"))
+        return allowAnchor ? value : null;
+    if (value.startsWith("//"))
+        return null;
+    try {
+        const parsed = new URL(value, BASE_URL);
+        const hasExplicitScheme = EXPLICIT_SCHEME_RE.test(value);
+        if (!hasExplicitScheme)
+            return allowRelative ? value : null;
+        return allowedProtocols.includes(parsed.protocol) ? parsed.href : null;
+    }
+    catch {
+        return null;
+    }
+}
+function hasRawControlOrSpace(value) {
+    for (const char of value) {
+        const code = char.charCodeAt(0);
+        if (code <= 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+export function sanitizeRenderedHtml(input) {
+    return sanitizeHtml(input, {
+        allowedTags: [
+            ...sanitizeHtml.defaults.allowedTags,
+            "button",
+            "details",
+            "iframe",
+            "img",
+            "path",
+            "source",
+            "summary",
+            "svg",
+            "video",
+        ],
+        allowedAttributes: {
+            "*": [
+                "class",
+                "id",
+                "role",
+                "tabindex",
+                "title",
+                "aria-expanded",
+                "aria-hidden",
+                "aria-label",
+                "aria-selected",
+                "data-clipboard-target",
+                "data-cols",
+                "data-copy-source",
+                "data-display",
+                "data-tab-group",
+                "data-tab-index",
+                "data-target",
+                "data-traverse-target",
+            ],
+            a: ["href", "name", "target", "rel", "title", "class", "id"],
+            button: [
+                "type",
+                "class",
+                "aria-expanded",
+                "aria-label",
+                "aria-selected",
+                "data-copy-source",
+                "data-tab-group",
+                "data-tab-index",
+            ],
+            div: [
+                "class",
+                "id",
+                "role",
+                "style",
+                "data-cols",
+                "data-tab-group",
+                "data-tab-index",
+                "data-traverse-target",
+            ],
+            details: ["class", "id", "open"],
+            h1: ["id", "class"],
+            h2: ["id", "class"],
+            h3: ["id", "class"],
+            h4: ["id", "class"],
+            h5: ["id", "class"],
+            h6: ["id", "class"],
+            iframe: ["src", "title", "frameborder", "allow", "allowfullscreen", "loading", "class", "id"],
+            img: ["src", "alt", "title", "width", "height", "loading", "class", "id"],
+            path: ["d", "fill", "stroke", "stroke-width", "stroke-linecap", "stroke-linejoin"],
+            pre: ["class", "tabindex", "style"],
+            source: ["src", "type"],
+            span: ["class", "style", "title"],
+            svg: [
+                "xmlns",
+                "width",
+                "height",
+                "viewBox",
+                "fill",
+                "stroke",
+                "stroke-width",
+                "stroke-linecap",
+                "stroke-linejoin",
+                "class",
+                "aria-hidden",
+                "focusable",
+            ],
+            table: ["class"],
+            td: ["class", "colspan", "rowspan"],
+            th: ["class", "colspan", "rowspan", "scope"],
+            video: ["controls", "preload", "title", "class", "id"],
+        },
+        allowedSchemes: ["http", "https", "mailto"],
+        allowedSchemesByTag: {
+            iframe: ["http", "https"],
+            img: ["http", "https"],
+            source: ["http", "https"],
+        },
+        allowProtocolRelative: false,
+        allowedStyles: {
+            "*": {
+                background: [/^transparent$/, /^#[0-9a-fA-F]{3,8}$/],
+                "background-color": [/^#[0-9a-fA-F]{3,8}$/],
+                color: [/^#[0-9a-fA-F]{3,8}$/],
+                height: [/^\d{1,4}px$/],
+                "--shiki-dark": [/^#[0-9a-fA-F]{3,8}$/],
+                "--shiki-dark-bg": [/^#[0-9a-fA-F]{3,8}$/],
+                "--shiki-light": [/^#[0-9a-fA-F]{3,8}$/],
+                "--shiki-light-bg": [/^#[0-9a-fA-F]{3,8}$/],
+            },
+        },
+    });
+}

package/dist/utils/http.d.ts

@@ -9,6 +9,4 @@ export declare function schemaRange(schema: {
     exclusiveMinimum?: number | boolean;
     exclusiveMaximum?: number | boolean;
 }): string | undefined;
-/** HTTP method color classes for badges */
-export declare function methodColor(method: string): string;
 //# sourceMappingURL=http.d.ts.map

package/dist/utils/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/utils/http.ts"],"names":[],"mappings":"AAiDA,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACrC,GAAG,MAAM,GAAG,SAAS,CA0BrB;AAED,2CAA2C;AAC3C,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBlD"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/utils/http.ts"],"names":[],"mappings":"AAiDA,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACrC,GAAG,MAAM,GAAG,SAAS,CA4BrB"}

package/dist/utils/http.js

@@ -54,43 +54,28 @@ export function httpStatusText(code) {
  * Fixes legacy bug where maximumExclusive was checked with minimumExclusive.
  */
 export function schemaRange(schema) {
-    const parts = [];
+    let min;
+    let max;
     if (schema.minimum !== undefined) {
-        const exclusive = schema.exclusiveMinimum === true ||
-            typeof schema.exclusiveMinimum === "number";
-        const min = typeof schema.exclusiveMinimum === "number"
-            ? schema.exclusiveMinimum
-            : schema.minimum;
-        parts.push(`${exclusive ? "(" : "["}${min}`);
+        const exclusive = schema.exclusiveMinimum === true || typeof schema.exclusiveMinimum === "number";
+        min = {
+            value: typeof schema.exclusiveMinimum === "number" ? schema.exclusiveMinimum : schema.minimum,
+            exclusive,
+        };
     }
     if (schema.maximum !== undefined) {
-        const exclusive = schema.exclusiveMaximum === true ||
-            typeof schema.exclusiveMaximum === "number";
-        const max = typeof schema.exclusiveMaximum === "number"
-            ? schema.exclusiveMaximum
-            : schema.maximum;
-        parts.push(`${max}${exclusive ? ")" : "]"}`);
+        const exclusive = schema.exclusiveMaximum === true || typeof schema.exclusiveMaximum === "number";
+        max = {
+            value: typeof schema.exclusiveMaximum === "number" ? schema.exclusiveMaximum : schema.maximum,
+            exclusive,
+        };
     }
-    return parts.length === 2 ? parts.join(", ") : undefined;
-}
-/** HTTP method color classes for badges */
-export function methodColor(method) {
-    switch (method.toLowerCase()) {
-        case "get":
-            return "bg-emerald-600";
-        case "post":
-            return "bg-blue-600";
-        case "put":
-            return "bg-amber-600";
-        case "delete":
-            return "bg-red-600";
-        case "patch":
-            return "bg-purple-600";
-        case "options":
-            return "bg-gray-500";
-        case "head":
-            return "bg-gray-600";
-        default:
-            return "bg-gray-500";
+    if (min && max) {
+        return `${min.exclusive ? "(" : "["}${min.value}, ${max.value}${max.exclusive ? ")" : "]"}`;
     }
+    if (min)
+        return `${min.exclusive ? ">" : ">="} ${min.value}`;
+    if (max)
+        return `${max.exclusive ? "<" : "<="} ${max.value}`;
+    return undefined;
 }

package/dist/utils/markdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/utils/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,KAAK,EAAe,MAAM,QAAQ,CAAC;AAKzD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CASnE;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAgJD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,EAAE,CAGnD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAe5D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAY5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAG3D"}
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/utils/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,KAAK,EAAe,MAAM,QAAQ,CAAC;AAMzD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CASnE;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAkLD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,EAAE,CAGnD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAe5D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAY5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA2BzD;AAsBD;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAG3D"}

package/dist/utils/markdown.js

@@ -2,6 +2,7 @@ import { Marked } from "marked";
 import { highlightCode } from "./highlighter.js";
 import { COPY_ICON_SVG } from "./copy-svg.js";
 import { htmlId } from "./html-id.js";
+import { escapeAttr, safeUrl, sanitizeRenderedHtml } from "./html.js";
 /**
  * Shared code block renderer used by all markdown rendering.
  * Outputs the prose-code-block wrapper with copy button and Shiki highlighting.
@@ -23,33 +24,46 @@ function parseDirectiveAttrs(raw) {
         attrs[k] = v;
     return attrs;
 }
-function escAttr(s) {
-    return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
-}
-function requireHttps(url) {
-    try {
-        const u = new URL(url);
-        if (u.protocol !== "https:" && u.protocol !== "http:")
-            return null;
-        return u.href;
+function parseVideoUrl(url) {
+    const webUrl = safeUrl(url, {
+        allowedProtocols: ["http:", "https:"],
+        allowRelative: false,
+        allowAnchor: false,
+    });
+    if (webUrl) {
+        const parsed = new URL(webUrl);
+        const hostname = parsed.hostname.replace(/^www\./, "");
+        if (hostname === "youtube.com" || hostname === "m.youtube.com") {
+            const id = parsed.searchParams.get("v");
+            if (id && /^[\w-]+$/.test(id)) {
+                return { src: `https://www.youtube-nocookie.com/embed/${id}`, type: "iframe" };
+            }
+        }
+        if (hostname === "youtu.be") {
+            const id = parsed.pathname.split("/").filter(Boolean)[0];
+            if (id && /^[\w-]+$/.test(id)) {
+                return { src: `https://www.youtube-nocookie.com/embed/${id}`, type: "iframe" };
+            }
+        }
+        if (hostname === "vimeo.com" || hostname.endsWith(".vimeo.com")) {
+            const id = parsed.pathname
+                .split("/")
+                .filter(Boolean)
+                .find((segment) => /^\d+$/.test(segment));
+            if (id)
+                return { src: `https://player.vimeo.com/video/${id}`, type: "iframe" };
+        }
     }
-    catch {
+    const rawVideoUrl = safeUrl(url, {
+        allowedProtocols: ["http:", "https:"],
+        allowRelative: true,
+        allowAnchor: false,
+    });
+    if (!rawVideoUrl)
         return null;
-    }
-}
-function parseVideoUrl(url) {
-    // YouTube
-    let m = url.match(/(?:youtube\.com\/watch\?v=|youtu\.be\/)([\w-]+)/);
-    if (m)
-        return { src: `https://www.youtube-nocookie.com/embed/${m[1]}`, type: "iframe" };
-    // Vimeo
-    m = url.match(/vimeo\.com\/(\d+)/);
-    if (m)
-        return { src: `https://player.vimeo.com/video/${m[1]}`, type: "iframe" };
-    // Raw video
-    const ext = url.split(".").pop()?.toLowerCase();
+    const ext = rawVideoUrl.split(/[?#]/)[0]?.split(".").pop()?.toLowerCase();
     const mime = ext === "webm" ? "video/webm" : "video/mp4";
-    return { src: url, type: "video", mime };
+    return { src: rawVideoUrl, type: "video", mime };
 }
 const videoExtension = {
     extensions: [
@@ -69,15 +83,17 @@ const videoExtension = {
             renderer(token) {
                 const { url, title } = token;
                 const parsed = parseVideoUrl(url);
-                const safeTitle = escAttr(title);
+                if (!parsed)
+                    return `<p>[video: invalid URL]</p>\n`;
+                const safeTitle = escapeAttr(title);
                 if (parsed.type === "iframe") {
                     return `<div class="prose-video not-prose">
-<iframe src="${parsed.src}" title="${safeTitle}" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy"></iframe>
+<iframe src="${escapeAttr(parsed.src)}" title="${safeTitle}" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy"></iframe>
 </div>\n`;
                 }
                 return `<div class="prose-video not-prose">
 <video controls preload="metadata" title="${safeTitle}">
-<source src="${parsed.src}" type="${parsed.mime}" />
+<source src="${escapeAttr(parsed.src)}" type="${escapeAttr(parsed.mime ?? "video/mp4")}" />
 </video>
 </div>\n`;
             },
@@ -98,15 +114,25 @@ const iframeExtension = {
                     return undefined;
                 const attrs = parseDirectiveAttrs(match[2] ?? "");
                 const height = parseInt(attrs.height ?? "", 10);
-                return { type: "iframe", raw: match[0], url: match[1], title: attrs.title ?? "", height: Number.isFinite(height) ? height : 400 };
+                return {
+                    type: "iframe",
+                    raw: match[0],
+                    url: match[1],
+                    title: attrs.title ?? "",
+                    height: Number.isFinite(height) ? height : 400,
+                };
             },
             renderer(token) {
                 const { url, title, height } = token;
-                const safeUrl = requireHttps(url);
-                if (!safeUrl)
+                const iframeUrl = safeUrl(url, {
+                    allowedProtocols: ["http:", "https:"],
+                    allowRelative: false,
+                    allowAnchor: false,
+                });
+                if (!iframeUrl)
                     return `<p>[iframe: invalid URL]</p>\n`;
                 return `<div class="prose-iframe not-prose" style="height:${height}px">
-<iframe src="${escAttr(safeUrl)}" title="${escAttr(title)}" frameborder="0" loading="lazy" allowfullscreen></iframe>
+<iframe src="${escapeAttr(iframeUrl)}" title="${escapeAttr(title)}" frameborder="0" loading="lazy" allowfullscreen></iframe>
 </div>\n`;
             },
         },
@@ -124,16 +150,23 @@ const marked = new Marked(videoExtension, iframeExtension, {
             return `<h${depth} id="${id}">${this.parser.parseInline(tokens)}</h${depth}>\n`;
         },
         table(token) {
-            const header = token.header.map((cell) => `<th>${this.parser.parseInline(cell.tokens)}</th>`).join("");
-            const body = token.rows.map((row) => `<tr>${row.map((cell) => `<td>${this.parser.parseInline(cell.tokens)}</td>`).join("")}</tr>`).join("\n");
+            const header = token.header
+                .map((cell) => `<th>${this.parser.parseInline(cell.tokens)}</th>`)
+                .join("");
+            const body = token.rows
+                .map((row) => `<tr>${row.map((cell) => `<td>${this.parser.parseInline(cell.tokens)}</td>`).join("")}</tr>`)
+                .join("\n");
             return `<div class="table-wrap"><table><thead><tr>${header}</tr></thead><tbody>${body}</tbody></table></div>`;
         },
         link({ href, title, tokens }) {
             const text = this.parser.parseInline(tokens);
-            const titleAttr = title ? ` title="${title}"` : "";
-            const isExternal = href.startsWith("http://") || href.startsWith("https://");
+            const linkUrl = safeUrl(href);
+            if (!linkUrl)
+                return text;
+            const titleAttr = title ? ` title="${escapeAttr(title)}"` : "";
+            const isExternal = linkUrl.startsWith("http://") || linkUrl.startsWith("https://");
             const target = isExternal ? ' target="_blank" rel="noopener noreferrer"' : "";
-            return `<a href="${href}"${titleAttr}${target}>${text}</a>`;
+            return `<a href="${escapeAttr(linkUrl)}"${titleAttr}${target}>${text}</a>`;
         },
     },
 });
@@ -193,7 +226,50 @@ export function extractFirstParagraph(input) {
 export function stripMarkdownLinks(input) {
     if (!input)
         return "";
-    return input.replace(/\[([^\]]+)\]\(([^)]+)\)/g, "$1");
+    let output = "";
+    let index = 0;
+    while (index < input.length) {
+        const isImage = input[index] === "!" && input[index + 1] === "[";
+        const isLink = input[index] === "[";
+        const labelStart = isImage ? index + 2 : isLink ? index + 1 : -1;
+        if (labelStart !== -1) {
+            const labelEnd = findMarkdownLabelEnd(input, labelStart);
+            if (labelEnd !== -1 && input[labelEnd + 1] === "(") {
+                const hrefEnd = findMarkdownHrefEnd(input, labelEnd + 2);
+                if (hrefEnd !== -1) {
+                    output += input.slice(labelStart, labelEnd);
+                    index = hrefEnd + 1;
+                    continue;
+                }
+            }
+        }
+        output += input[index];
+        index += 1;
+    }
+    return output;
+}
+function findMarkdownLabelEnd(input, start) {
+    let inCode = false;
+    for (let i = start; i < input.length; i += 1) {
+        const char = input[i];
+        if (char === "`")
+            inCode = !inCode;
+        if (char === "\n")
+            return -1;
+        if (char === "]" && !inCode)
+            return i;
+    }
+    return -1;
+}
+function findMarkdownHrefEnd(input, start) {
+    for (let i = start; i < input.length; i += 1) {
+        const char = input[i];
+        if (char === "\n")
+            return -1;
+        if (char === ")")
+            return i;
+    }
+    return -1;
 }
 /**
  * Render Markdown to HTML.
@@ -201,7 +277,7 @@ export function stripMarkdownLinks(input) {
 export function renderMarkdown(input) {
     if (!input)
         return "";
-    return marked.parse(input, { async: false });
+    return sanitizeRenderedHtml(marked.parse(input, { async: false }));
 }
 /**
  * Render Markdown to inline HTML (strip wrapping <p> tags).
@@ -209,5 +285,5 @@ export function renderMarkdown(input) {
 export function renderMarkdownInline(input) {
     if (!input)
         return "";
-    return marked.parseInline(input, { async: false });
+    return sanitizeRenderedHtml(marked.parseInline(input, { async: false }));
 }

package/dist/vite-plugin.d.ts

@@ -8,6 +8,8 @@ export interface SourceyPluginOptions {
     render: (url: string) => Promise<string | null>;
     /** Optional: generate search index JSON on demand */
     searchIndex?: () => Promise<string>;
+    /** Optional: serve generated/copied files that do not go through Vite's static handler. */
+    extraFile?: (outputPath: string) => Promise<string | Buffer | undefined>;
 }
 /**
  * Vite plugin for Sourcey.

package/dist/vite-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin.d.ts","sourceRoot":"","sources":["../src/vite-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAC;AAKlD,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,iEAAiE;IACjE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChD,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CA4GnE"}
+{"version":3,"file":"vite-plugin.d.ts","sourceRoot":"","sources":["../src/vite-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAC;AAKlD,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,iEAAiE;IACjE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChD,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,2FAA2F;IAC3F,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CA6HnE"}