1
function escapeHtml(s: string): string {
2
  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
3
}
4
 
5
/** Sanitize FTS5 snippet() output, preserving <mark> delimiters. */
6
export function sanitizeSnippet(raw: string): string {
7
  return raw
8
    .split(/(<mark>|<\/mark>)/g)
9
    .map((part) => (part === "<mark>" || part === "</mark>" ? part : escapeHtml(part)))
10
    .join("");
11
}