Function markdownAssetIsExecutable

src/services/packagePreview.ts:194–207

(
	originalPath: string,
	content: string,
)

// note that actually contains a runnable js fence is treated as executable, so
// plain `.md` templates are not flagged. Pure/App-free — operates on the payload.
function markdownAssetIsExecutable(
	originalPath: string,
	content: string,
): boolean {
	if (!MARKDOWN_FILE_EXTENSION_REGEX.test(originalPath)) return false;
	let decoded: string;
	try {
		decoded = decodeFromBase64(content);
	} catch {
		return false;
	}
	const { code } = extractScriptFromMarkdown(decoded);
	return code !== null && code.length > 0;
}

// The runnable code of a bundled executable asset, for static disclosure scans:
// a `.md` note yields its first js fence (what the loader runs); any other