{"version":3,"sources":["../src/sanitize.ts"],"sourcesContent":["// Sanitize text to prevent HTML/markdown injection from untrusted sources.\n// Escapes HTML special characters: & < > \" '\nexport function sanitizeHtml(text: string): string {\n  return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\"/g, '&quot;').replace(/'/g, '&#39;');\n}\n\n// Sanitize text for safe markdown/MDX embedding: escape HTML special chars and markdown link syntax\nexport function sanitizeMarkdownText(text: string): string {\n  return sanitizeHtml(text).replace(/[[\\]()]/g, (char) => `\\\\${char}`);\n}\n\n// Sanitize URL for safe markdown link embedding: only allow http/https protocols\nexport function sanitizeUrl(url: string): string {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {\n      return url.replace(/[()]/g, (char) => encodeURIComponent(char));\n    }\n    return '';\n  } catch {\n    return '';\n  }\n}\n\n// Sanitize IDs to prevent path traversal from untrusted sources\nexport function sanitizeId(id: string): string {\n  return id.replace(/[^a-zA-Z0-9-_]/g, '-');\n}\n"],"mappings":";AAEO,SAAS,aAAa,MAAsB;AACjD,SAAO,KAAK,QAAQ,MAAM,OAAO,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,QAAQ,EAAE,QAAQ,MAAM,OAAO;AAC9H;AAGO,SAAS,qBAAqB,MAAsB;AACzD,SAAO,aAAa,IAAI,EAAE,QAAQ,YAAY,CAAC,SAAS,KAAK,IAAI,EAAE;AACrE;AAGO,SAAS,YAAY,KAAqB;AAC/C,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,aAAO,IAAI,QAAQ,SAAS,CAAC,SAAS,mBAAmB,IAAI,CAAC;AAAA,IAChE;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,WAAW,IAAoB;AAC7C,SAAO,GAAG,QAAQ,mBAAmB,GAAG;AAC1C;","names":[]}