DocEngine

Configurable markdown-to-HTML rendering library with sanitization presets. Built on pulldown-cmark (GFM) and ammonia.

Used by MNW (site docs, blog posts, user-generated content), Multithreaded (forum posts), and the desktop apps (descriptions, notes).

Internal: not published to crates.io. Consumed by path in-tree, and by git dependency from anything built in a container, where a cross-repo path dependency is not reachable.

Presets

Five rendering presets, each with different security/feature tradeoffs:

Plain text

The presets all answer “how do I show this markdown”. render_plain answers “what does this markdown say”, for the places that cannot take markup at all: a list row’s preview line, a notification body, a search snippet, an alt attribute. Block structure survives as newlines; emphasis, code spans and link URLs do not. It produces text, not safe HTML, so whatever puts that text in a document still escapes it.

use docengine::{render_chat, render_permissive, render_plain, render_standard, render_strict, sanitize_html};

// Convenience functions
let html = render_permissive("# Hello\n\n**Bold** text");
let html = render_standard("A description with [link](https://example.com)");
let html = render_strict("User post with @mentions and `code`");
let html = render_chat("A chat message with a [link](https://example.com)");
let html = sanitize_html("<p>Pre-rendered</p><script>stripped</script>");

// Markdown to text, for a preview line rather than a document
let text = render_plain("See **the [docs](https://example.com)**."); // "See the docs." 

// Builder pattern for custom configurations
use docengine::{Renderer, SanitizePreset};

let html = Renderer::permissive()
    .with_strip_images(true)       // override: strip images even in permissive
    .with_footnotes(false)
    .render("# Custom config");

// Render with metadata (word count, reading time)
let result = Renderer::standard().render_with_meta("Some article text...");
println!("{} words, ~{} min read", result.word_count, result.reading_time_minutes);

Feature Flags

All optional features are off by default. Enable what you need:

# In Cargo.toml
docengine = { path = "../../Libraries/docengine" }                 # From MNW/server/ or Apps/
docengine = { git = "https://makenot.work/git/max/docengine" }     # From a container build

The path form needs the ~/Code layout on disk, which a clone does not reproduce. Anything building in a container takes the git form.

Core API

Types

• Renderer – configurable markdown renderer with builder pattern
• RenderResult – rendered HTML plus word_count and reading_time_minutes
• SanitizePreset – Permissive, Standard, Strict, Minimal, Chat
• TocEntry – heading level, text, and anchor for table of contents

Functions

Feature-gated

Value substitution

{{ dotted.path | filter(args) }} substitution is not a docengine feature. It lives in subst (the generic engine) and mnw-assumptions (the MNW business-model layer on top), both in the MNW tree. The seam is DocLoaderConfig::pre_process: MNW’s server builds an Assumptions at boot and hands over its substitute. Any other pre-render text transform plugs into the same hook.

Consumers

Security

All presets sanitize output through ammonia. The strict preset additionally:

• Strips all raw HTML and images at the parser level (before ammonia)
• Replaces javascript:, data:, vbscript: URLs with #
• Adds rel="noopener noreferrer nofollow" to all links

The chat preset is strict plus an inline-only tag allowlist, and it carries one guarantee the others do not state: rendering a message makes no outbound request. A link becomes an anchor and stays one. There is no preview fetch, no URL resolution, no metadata lookup, and no HTTP client anywhere in this crate’s dependency tree – chat_render_path_cannot_fetch asserts the last of those against the lockfile, so a fetcher cannot be added without a test failing first.

Zero unsafe code.

License

MIT. See LICENSE.

Permissive on purpose. The products carry a different license: MNW and Multithreaded are PolyForm Noncommercial, while the libraries meant for reuse are MIT. That split is what lets a GPL consumer link this crate at all, since PolyForm’s noncommercial term is an added restriction GPL section 7 forbids.