specra 0.2.58 → 0.2.59

package/dist/mdx-security.d.ts

@@ -23,8 +23,19 @@ export declare function validatePathWithinDirectory(filePath: string, allowedDir
  */
 export declare function scanMDXForDangerousPatterns(content: string): string[];
 /**
- * Sanitize MDX content by removing/escaping dangerous patterns
- * This is a defensive measure - ideally content should be rejected if dangerous
+ * Sanitize MDX content by neutralizing dangerous patterns in executable prose,
+ * while leaving fenced code blocks and inline code completely untouched.
+ *
+ * Code spans are not executable — the code renderer displays their contents as
+ * escaped text — so dangerous-looking examples inside them (e.g. a documented
+ * `<script>` tag) must be preserved verbatim, never stripped. We mask code spans
+ * with placeholder tokens, sanitize only the surrounding prose, then restore
+ * them unchanged.
+ *
+ * In prose, script tags are *escaped* (turned into inert, visible literal text)
+ * rather than deleted, so content never silently vanishes. Event-handler
+ * attributes and `javascript:` URLs are invisible attack vectors on otherwise
+ * valid HTML, so those are removed (neutralizing them deletes no visible text).
  */
 export declare function sanitizeMDXContent(content: string, strict?: boolean): string;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specra",
-  "version": "0.2.58",
+  "version": "0.2.59",
   "description": "A modern documentation library for SvelteKit with built-in versioning, API reference generation, full-text search, and MDX support",
   "svelte": "./dist/index.js",
   "types": "./dist/index.d.ts",