sourcey 3.6.0 → 3.6.2

package/dist/utils/http.js

@@ -54,43 +54,28 @@ export function httpStatusText(code) {
  * Fixes legacy bug where maximumExclusive was checked with minimumExclusive.
  */
 export function schemaRange(schema) {
-    const parts = [];
+    let min;
+    let max;
     if (schema.minimum !== undefined) {
-        const exclusive = schema.exclusiveMinimum === true ||
-            typeof schema.exclusiveMinimum === "number";
-        const min = typeof schema.exclusiveMinimum === "number"
-            ? schema.exclusiveMinimum
-            : schema.minimum;
-        parts.push(`${exclusive ? "(" : "["}${min}`);
+        const exclusive = schema.exclusiveMinimum === true || typeof schema.exclusiveMinimum === "number";
+        min = {
+            value: typeof schema.exclusiveMinimum === "number" ? schema.exclusiveMinimum : schema.minimum,
+            exclusive,
+        };
     }
     if (schema.maximum !== undefined) {
-        const exclusive = schema.exclusiveMaximum === true ||
-            typeof schema.exclusiveMaximum === "number";
-        const max = typeof schema.exclusiveMaximum === "number"
-            ? schema.exclusiveMaximum
-            : schema.maximum;
-        parts.push(`${max}${exclusive ? ")" : "]"}`);
+        const exclusive = schema.exclusiveMaximum === true || typeof schema.exclusiveMaximum === "number";
+        max = {
+            value: typeof schema.exclusiveMaximum === "number" ? schema.exclusiveMaximum : schema.maximum,
+            exclusive,
+        };
     }
-    return parts.length === 2 ? parts.join(", ") : undefined;
-}
-/** HTTP method color classes for badges */
-export function methodColor(method) {
-    switch (method.toLowerCase()) {
-        case "get":
-            return "bg-emerald-600";
-        case "post":
-            return "bg-blue-600";
-        case "put":
-            return "bg-amber-600";
-        case "delete":
-            return "bg-red-600";
-        case "patch":
-            return "bg-purple-600";
-        case "options":
-            return "bg-gray-500";
-        case "head":
-            return "bg-gray-600";
-        default:
-            return "bg-gray-500";
+    if (min && max) {
+        return `${min.exclusive ? "(" : "["}${min.value}, ${max.value}${max.exclusive ? ")" : "]"}`;
     }
+    if (min)
+        return `${min.exclusive ? ">" : ">="} ${min.value}`;
+    if (max)
+        return `${max.exclusive ? "<" : "<="} ${max.value}`;
+    return undefined;
 }

package/dist/utils/markdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/utils/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,KAAK,EAAe,MAAM,QAAQ,CAAC;AAOzD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CASnE;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AA2JD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,EAAE,CAGnD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAe5D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAY5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAG3D"}
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/utils/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,KAAK,EAAe,MAAM,QAAQ,CAAC;AAMzD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CASnE;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAkLD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,EAAE,CAGnD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAe5D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAY5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA2BzD;AAsBD;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAG3D"}

package/dist/utils/markdown.js

@@ -2,7 +2,7 @@ import { Marked } from "marked";
 import { highlightCode } from "./highlighter.js";
 import { COPY_ICON_SVG } from "./copy-svg.js";
 import { htmlId } from "./html-id.js";
-const MARKDOWN_LINK_RE = /\[((?:`[^`]*`|[^\]])+)\]\(([^)]+)\)/g;
+import { escapeAttr, safeUrl, sanitizeRenderedHtml } from "./html.js";
 /**
  * Shared code block renderer used by all markdown rendering.
  * Outputs the prose-code-block wrapper with copy button and Shiki highlighting.
@@ -24,33 +24,46 @@ function parseDirectiveAttrs(raw) {
         attrs[k] = v;
     return attrs;
 }
-function escAttr(s) {
-    return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
-}
-function requireHttps(url) {
-    try {
-        const u = new URL(url);
-        if (u.protocol !== "https:" && u.protocol !== "http:")
-            return null;
-        return u.href;
+function parseVideoUrl(url) {
+    const webUrl = safeUrl(url, {
+        allowedProtocols: ["http:", "https:"],
+        allowRelative: false,
+        allowAnchor: false,
+    });
+    if (webUrl) {
+        const parsed = new URL(webUrl);
+        const hostname = parsed.hostname.replace(/^www\./, "");
+        if (hostname === "youtube.com" || hostname === "m.youtube.com") {
+            const id = parsed.searchParams.get("v");
+            if (id && /^[\w-]+$/.test(id)) {
+                return { src: `https://www.youtube-nocookie.com/embed/${id}`, type: "iframe" };
+            }
+        }
+        if (hostname === "youtu.be") {
+            const id = parsed.pathname.split("/").filter(Boolean)[0];
+            if (id && /^[\w-]+$/.test(id)) {
+                return { src: `https://www.youtube-nocookie.com/embed/${id}`, type: "iframe" };
+            }
+        }
+        if (hostname === "vimeo.com" || hostname.endsWith(".vimeo.com")) {
+            const id = parsed.pathname
+                .split("/")
+                .filter(Boolean)
+                .find((segment) => /^\d+$/.test(segment));
+            if (id)
+                return { src: `https://player.vimeo.com/video/${id}`, type: "iframe" };
+        }
     }
-    catch {
+    const rawVideoUrl = safeUrl(url, {
+        allowedProtocols: ["http:", "https:"],
+        allowRelative: true,
+        allowAnchor: false,
+    });
+    if (!rawVideoUrl)
         return null;
-    }
-}
-function parseVideoUrl(url) {
-    // YouTube
-    let m = url.match(/(?:youtube\.com\/watch\?v=|youtu\.be\/)([\w-]+)/);
-    if (m)
-        return { src: `https://www.youtube-nocookie.com/embed/${m[1]}`, type: "iframe" };
-    // Vimeo
-    m = url.match(/vimeo\.com\/(\d+)/);
-    if (m)
-        return { src: `https://player.vimeo.com/video/${m[1]}`, type: "iframe" };
-    // Raw video
-    const ext = url.split(".").pop()?.toLowerCase();
+    const ext = rawVideoUrl.split(/[?#]/)[0]?.split(".").pop()?.toLowerCase();
     const mime = ext === "webm" ? "video/webm" : "video/mp4";
-    return { src: url, type: "video", mime };
+    return { src: rawVideoUrl, type: "video", mime };
 }
 const videoExtension = {
     extensions: [
@@ -70,15 +83,17 @@ const videoExtension = {
             renderer(token) {
                 const { url, title } = token;
                 const parsed = parseVideoUrl(url);
-                const safeTitle = escAttr(title);
+                if (!parsed)
+                    return `<p>[video: invalid URL]</p>\n`;
+                const safeTitle = escapeAttr(title);
                 if (parsed.type === "iframe") {
                     return `<div class="prose-video not-prose">
-<iframe src="${parsed.src}" title="${safeTitle}" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy"></iframe>
+<iframe src="${escapeAttr(parsed.src)}" title="${safeTitle}" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy"></iframe>
 </div>\n`;
                 }
                 return `<div class="prose-video not-prose">
 <video controls preload="metadata" title="${safeTitle}">
-<source src="${parsed.src}" type="${parsed.mime}" />
+<source src="${escapeAttr(parsed.src)}" type="${escapeAttr(parsed.mime ?? "video/mp4")}" />
 </video>
 </div>\n`;
             },
@@ -109,11 +124,15 @@ const iframeExtension = {
             },
             renderer(token) {
                 const { url, title, height } = token;
-                const safeUrl = requireHttps(url);
-                if (!safeUrl)
+                const iframeUrl = safeUrl(url, {
+                    allowedProtocols: ["http:", "https:"],
+                    allowRelative: false,
+                    allowAnchor: false,
+                });
+                if (!iframeUrl)
                     return `<p>[iframe: invalid URL]</p>\n`;
                 return `<div class="prose-iframe not-prose" style="height:${height}px">
-<iframe src="${escAttr(safeUrl)}" title="${escAttr(title)}" frameborder="0" loading="lazy" allowfullscreen></iframe>
+<iframe src="${escapeAttr(iframeUrl)}" title="${escapeAttr(title)}" frameborder="0" loading="lazy" allowfullscreen></iframe>
 </div>\n`;
             },
         },
@@ -141,10 +160,13 @@ const marked = new Marked(videoExtension, iframeExtension, {
         },
         link({ href, title, tokens }) {
             const text = this.parser.parseInline(tokens);
-            const titleAttr = title ? ` title="${title}"` : "";
-            const isExternal = href.startsWith("http://") || href.startsWith("https://");
+            const linkUrl = safeUrl(href);
+            if (!linkUrl)
+                return text;
+            const titleAttr = title ? ` title="${escapeAttr(title)}"` : "";
+            const isExternal = linkUrl.startsWith("http://") || linkUrl.startsWith("https://");
             const target = isExternal ? ' target="_blank" rel="noopener noreferrer"' : "";
-            return `<a href="${href}"${titleAttr}${target}>${text}</a>`;
+            return `<a href="${escapeAttr(linkUrl)}"${titleAttr}${target}>${text}</a>`;
         },
     },
 });
@@ -204,7 +226,50 @@ export function extractFirstParagraph(input) {
 export function stripMarkdownLinks(input) {
     if (!input)
         return "";
-    return input.replace(MARKDOWN_LINK_RE, "$1");
+    let output = "";
+    let index = 0;
+    while (index < input.length) {
+        const isImage = input[index] === "!" && input[index + 1] === "[";
+        const isLink = input[index] === "[";
+        const labelStart = isImage ? index + 2 : isLink ? index + 1 : -1;
+        if (labelStart !== -1) {
+            const labelEnd = findMarkdownLabelEnd(input, labelStart);
+            if (labelEnd !== -1 && input[labelEnd + 1] === "(") {
+                const hrefEnd = findMarkdownHrefEnd(input, labelEnd + 2);
+                if (hrefEnd !== -1) {
+                    output += input.slice(labelStart, labelEnd);
+                    index = hrefEnd + 1;
+                    continue;
+                }
+            }
+        }
+        output += input[index];
+        index += 1;
+    }
+    return output;
+}
+function findMarkdownLabelEnd(input, start) {
+    let inCode = false;
+    for (let i = start; i < input.length; i += 1) {
+        const char = input[i];
+        if (char === "`")
+            inCode = !inCode;
+        if (char === "\n")
+            return -1;
+        if (char === "]" && !inCode)
+            return i;
+    }
+    return -1;
+}
+function findMarkdownHrefEnd(input, start) {
+    for (let i = start; i < input.length; i += 1) {
+        const char = input[i];
+        if (char === "\n")
+            return -1;
+        if (char === ")")
+            return i;
+    }
+    return -1;
 }
 /**
  * Render Markdown to HTML.
@@ -212,7 +277,7 @@ export function stripMarkdownLinks(input) {
 export function renderMarkdown(input) {
     if (!input)
         return "";
-    return marked.parse(input, { async: false });
+    return sanitizeRenderedHtml(marked.parse(input, { async: false }));
 }
 /**
  * Render Markdown to inline HTML (strip wrapping <p> tags).
@@ -220,5 +285,5 @@ export function renderMarkdown(input) {
 export function renderMarkdownInline(input) {
     if (!input)
         return "";
-    return marked.parseInline(input, { async: false });
+    return sanitizeRenderedHtml(marked.parseInline(input, { async: false }));
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sourcey",
-  "version": "3.6.0",
-  "description": "Precision documentation from OpenAPI, MCP, Doxygen, godoc, and Markdown. Static HTML you own.",
+  "version": "3.6.2",
+  "description": "Precision documentation from OpenAPI, MCP, Doxygen, godoc, rustdoc, and Markdown. Static HTML you own.",
   "type": "module",
   "engines": {
     "node": ">=20"
@@ -20,7 +20,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc && cp -r src/themes dist/ && cp src/client/*.js dist/client/ && cp -r src/og/fonts dist/og/ && rm -rf dist/core/sourcey-godoc dist/core/godoc-introspect && mkdir -p dist/core/sourcey-godoc && cp -R go/sourcey-godoc/go.mod go/sourcey-godoc/doc.go go/sourcey-godoc/cmd dist/core/sourcey-godoc/",
+    "build": "tsc && cp -r src/themes dist/ && cp src/client/*.js dist/client/ && cp -r src/og/fonts dist/og/ && rm -rf dist/core/sourcey-godoc dist/core/godoc-introspect && mkdir -p dist/core/sourcey-godoc && cp -R go/sourcey-godoc/go.mod go/sourcey-godoc/doc.go go/sourcey-godoc/cmd dist/core/sourcey-godoc/ && rm -rf dist/core/sourcey-rustdoc && mkdir -p dist/core/sourcey-rustdoc && cp -R rust/sourcey-rustdoc/Cargo.toml rust/sourcey-rustdoc/Cargo.lock rust/sourcey-rustdoc/README.md rust/sourcey-rustdoc/src rust/sourcey-rustdoc/tests dist/core/sourcey-rustdoc/",
     "watch": "npm run build && tsc --watch --preserveWatchOutput",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -37,7 +37,6 @@
   "dependencies": {
     "@apidevtools/json-schema-ref-parser": "^13.0.5",
     "@preact/preset-vite": "^2.10.4",
-    "@readme/openapi-parser": "^4.0.0",
     "@resvg/resvg-js": "^2.6.2",
     "@tailwindcss/typography": "^0.5.19",
     "@tailwindcss/vite": "^4.2.2",
@@ -47,9 +46,10 @@
     "js-yaml": "^4.1.0",
     "marked": "^15.0.0",
     "mcp-parser": "^0.4.0",
-    "moxygen": "^2.1.8",
+    "moxygen": "^2.1.10",
     "preact": "^10.28.4",
     "preact-render-to-string": "^6.6.6",
+    "sanitize-html": "^2.17.4",
     "satori": "^0.26.0",
     "shiki": "^4.0.2",
     "swagger2openapi": "^7.0.8",
@@ -57,8 +57,10 @@
     "vite": "^8.0.9"
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.4",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.19.15",
+    "@types/sanitize-html": "^2.16.1",
     "eslint": "^9.0.0",
     "eslint-config-prettier": "^10.0.0",
     "prettier": "^3.4.0",
@@ -78,9 +80,12 @@
     "developer-documentation",
     "doxygen",
     "godoc",
+    "rustdoc",
     "golang",
+    "rust",
     "go-docs",
     "go-documentation",
+    "rust-docs",
     "mcp",
     "llms-txt",
     "static-docs"