Add highlight text transformation

.commitlintrc.json

@@ -0,0 +1,27 @@
+{
+  "extends": ["@commitlint/config-conventional"],
+  "rules": {
+    "subject-case": [0],
+		"subject-empty": [2, "never"],
+		"subject-full-stop": [2, "never", "."],
+    "type-enum": [
+      2,
+      "always",
+      [
+        "build",
+        "chore",
+        "ci",
+        "docs",
+        "feat",
+        "fix",
+        "perf",
+        "refactor",
+        "revert",
+        "style",
+        "test",
+        "sample"
+      ]
+    ],
+    "type-empty": [2, "never"]
+  }
+}

.cursor/rules/README.md

@@ -0,0 +1,26 @@
+# Cursor rules — `@contentstack/utils`
+
+This folder holds project-specific rules for AI assistants working in **contentstack-utils-javascript**. For the full project overview, see **[`AGENTS.md`](../../AGENTS.md)** at the repository root.
+
+## How rules are picked up
+
+Each rule is a `.md`/`.mdc` file. Files with YAML frontmatter can set `description`, `globs`, and `alwaysApply`. Cursor uses these to decide when a rule is included in context.
+
+### Referencing rules in chat
+
+In Cursor, you can **`@`-mention** a rule file (e.g. type `@` and choose the rule from the list) to force its guidance into the conversation. The file name (without extension) is the usual handle, e.g. **`typescript`**, **`testing`**, **`code-review`**.
+
+## Rule index
+
+| File | `alwaysApply` | Globs | When it applies |
+|------|----------------|-------|------------------|
+| [`dev-workflow.md`](dev-workflow.md) | no | *(none)* | Branching, CI alignment, commits, releases, and day-to-day commands for this repo. |
+| [`typescript.mdc`](typescript.mdc) | no | `src/**/*.ts`, `__test__/**/*.ts` | TypeScript version, layout, ESLint/Prettier, strictness, imports. |
+| [`typescript-contentstack-utils.mdc`](typescript-contentstack-utils.mdc) | no | `src/**/*.ts` | Delivery-oriented utils only: RTE rendering, GQL helpers, endpoints JSON, Live Preview tags—**not** full CDA/CMA SDK surface. |
+| [`testing.mdc`](testing.mdc) | no | `__test__/**/*.ts` | Jest, jsdom, mocks, coverage output paths, no live-test env. |
+| [`code-review.mdc`](code-review.mdc) | **yes** | *(global)* | PR checklist: public API docs, compatibility, errors, dependencies, terminology (utils + delivery context). |
+
+## Related
+
+- **[`AGENTS.md`](../../AGENTS.md)** — Single entry point (package purpose, stack, commands).
+- **[`skills/README.md`](../../skills/README.md)** — Longer-form skill docs for the same themes.

.cursor/rules/code-review.mdc

@@ -0,0 +1,41 @@
+---
+description: PR review checklist for @contentstack/utils — API docs, compatibility, security, testing
+alwaysApply: true
+---
+
+# Code review checklist — `@contentstack/utils`
+
+Use severity labels (**Blocker / Major / Minor**) when triaging findings.
+
+## Public API and documentation
+
+- **Blocker/Major:** New or changed **exports** from `src/index.ts` need accurate **JSDoc** (or clear type names) matching runtime behavior.
+- **Major:** README / CHANGELOG updates when behavior is user-visible or migration is needed.
+
+## Backward compatibility
+
+- **Blocker:** Unplanned breaking changes to **function signatures** or **default behavior** consumed by Delivery SDK integrations or documented `renderOption` contracts.
+- **Major:** Stricter throwing on inputs that previously passed (especially `getContentstackEndpoint`, RTE traversals).
+
+## Errors
+
+- This package uses **plain `Error`** (e.g. `endpoints.ts`); new code should keep messages actionable. **Major:** Silent failures where callers need to detect bad input.
+
+## Null safety and RTE edge cases
+
+- **Major:** Missing guards on **null/undefined** node or entry fragments (historically sensitive in `entry-editable` / RTE paths).
+- **Minor:** Align with **`strictNullChecks: false`** legacy but avoid widening undefined leaks into public types.
+
+## Dependencies and SCA
+
+- **Major:** New runtime deps are rare—justify any addition; **`prepublishOnly`** and hooks assume **`npm test`** and Snyk-friendly trees.
+- Use **`npm audit` / Snyk** expectations per org policy.
+
+## Tests
+
+- **Blocker:** Behavioral fixes or new branches without **`__test__`** coverage when risk is high (RTE nesting, GQL URL rewriting, endpoint resolution).
+- **Minor:** Snapshot-only tests where a small assertion would be clearer.
+
+## Terminology
+
+- **Major:** Docs/comments must describe this as **utils** alongside **CDA / Delivery / JSON RTE / GraphQL**, not as **CMA** unless the change is explicitly management-related.

.cursor/rules/dev-workflow.md

@@ -0,0 +1,38 @@
+---
+description: Branching, CI, local commands, commit hooks, and release flow for contentstack-utils-javascript
+alwaysApply: false
+---
+
+# Dev workflow — `@contentstack/utils`
+
+## Branches and PRs
+
+- **CI** (`Unit-Test-CI`) runs on **push/PR** to `development`, `staging`, and `master` (see `.github/workflows/ci.yml`).
+- **Branch protection:** A workflow fails PRs that target **`staging`** when the head branch is **not** `development` (see `.github/workflows/check-branch.yml`). Prefer **`development`** as the integration branch when contributing upstream.
+- Target the branch your team uses for integration; align with maintainers if unsure.
+
+## Local development
+
+| Task | Command / note |
+|------|----------------|
+| Build | `npm run build` (runs `prebuild`: clean `dist`, `download-regions`, then `tsc` + Rollup) |
+| Test | `npm test` (includes `pretest` → build; Jest + coverage; `reports/`) |
+| Format | `npm run format` (Prettier: `src/**/*.ts`) |
+| ESLint | No `lint` script in `package.json`; run e.g. `npx eslint src __test__` using `eslint.config.js` |
+
+## Git hooks (Husky)
+
+- **`commit-msg`:** [Conventional Commits](https://www.conventionalcommits.org/) via **`commitlint`** (`.commitlintrc.json`).
+- **`pre-commit`:** Requires **Snyk** (`snyk test --all-projects`) and **Talisman** installed locally. Set `SKIP_HOOK=1` to bypass (documented in the hook).
+
+## PR expectations
+
+- **`npm test`** passes (build + unit tests).
+- **CHANGELOG.md** updated for user-visible changes when maintainers expect it.
+- **Dependencies:** Be mindful of Snyk/SCA workflows; security-relevant bumps should be justified.
+
+## Releases and versioning
+
+- **Package version** lives in **`package.json`** (also reflected in **`CHANGELOG.md`**).
+- **`prepublishOnly`** runs **`npm test`** before publish.
+- **NPM / GitHub Packages:** Publishing is driven by **GitHub release `created`** (`.github/workflows/npm-publish.yml`); requires maintainer secrets (`NPM_TOKEN`, `GIT_TOKEN`). Bump version and changelog in the same change set as the release your team uses.

.cursor/rules/testing.mdc

@@ -0,0 +1,38 @@
+---
+description: Jest tests, mocks, reports, and environments for @contentstack/utils
+globs:
+  - __test__/**/*.ts
+alwaysApply: false
+---
+
+# Testing — `@contentstack/utils`
+
+## Framework
+
+- **Jest 29** with **`ts-jest`** preset (`jest.config.ts`).
+- **Environment:** **`jsdom`** (suitable for HTML string assertions and DOM-related behavior).
+
+## Discovery and naming
+
+- **Pattern:** `**/__test__/**/?(*.)+(spec|test).[jt]s?(x)` — this repo uses `*.test.ts` under **`__test__/`**.
+- **Mocks / fixtures:** `__test__/mock/*.ts` — follow existing mock naming (`*-mock.ts`).
+
+## Coverage and reports
+
+- **Coverage** is collected from `src/**` excluding `src/index.ts` (`collectCoverageFrom`).
+- Outputs: **`reports/coverage/`**, **`reports/html/`** (jest-html-reporters), **`reports/junit/`** (jest-junit), **`reports/report.json`** (from `npm test` script).
+
+## Running tests
+
+| Command | Behavior |
+|---------|----------|
+| `npm test` | Runs **`pretest` → build** then Jest (CI-aligned). |
+| `npm run test:debug` | Watch mode, `--runInBand`. |
+
+## Integration / live tests
+
+- **None** in this repo. No `.env` or stack credentials required for **`npm test`**.
+
+## Build dependency
+
+- **`npm test` always builds first** (`pretest`). Ensure **`src/assets/regions.json`** exists or can be downloaded so `endpoints` tests pass.

.cursor/rules/typescript-contentstack-utils.mdc

@@ -0,0 +1,34 @@
+---
+description: Contentstack utils package patterns — RTE, embedded items, GQL, endpoints (delivery-oriented companion, not CDA/CMA SDK)
+globs:
+  - src/**/*.ts
+alwaysApply: false
+---
+
+# `@contentstack/utils` — domain patterns
+
+This repository implements **companion utilities** for Contentstack **content consumption** scenarios (typically with the **Delivery SDK** and **CDA / GraphQL** responses). It does **not** implement stack configuration, delivery tokens, or HTTP clients—callers fetch entry JSON elsewhere and pass it into these helpers.
+
+## Mental model
+
+| Area | Source anchors | Notes |
+|------|----------------|-------|
+| Render options / callbacks | `src/options/`, `src/render-embedded-objects.ts` | `RenderOption`-style maps: node types, marks, `block` / `inline` embeds, `reference`, `display`, `default`. |
+| JSON RTE → HTML | `src/json-to-html.ts`, `src/nodes/*`, `src/helper/*` | Supercharged RTE path uses `paths` arrays for nested fields (see `README.md`). |
+| Embedded object types | `src/Models/embedded-object.ts`, `src/Models/json-rte-model.ts` | Align typings with shapes coming from **delivery** entry JSON, not management APIs. |
+| GraphQL | `src/gql.ts`, `src/updateAssetURLForGQL.ts` | Docs/comments describe use **after** GraphQL fetches; asset URL rewriting is response-shape specific. |
+| Live Preview / CSLP tags | `src/entry-editable.ts` | `addTags` / exported `addEditableTags` — preserve existing attribute and locale behavior when changing tag generation. |
+| Region endpoints | `src/endpoints.ts` | **`getContentstackEndpoint(region, service?, omitHttps?)`** reads **`src/assets/regions.json`**; throws plain `Error` with human-readable messages on bad region/service. |
+
+## Terminology
+
+- Prefer **CDA / Delivery / JSON RTE / GraphQL** vocabulary when describing behavior—**not** CMA unless you are explicitly discussing something management-only (rare here).
+- **“SDK”** in docs often means **this utils package** or the **Delivery SDK** together—disambiguate in user-facing text.
+
+## Concurrency / IO
+
+- Pure synchronous transforms dominate; no retry or rate-limit layer. Do not add HTTP clients without an explicit product requirement.
+
+## Official docs alignment
+
+- Behavior should stay consistent with current **Content Delivery** / **Live Preview** / **JSON RTE** documentation. When in doubt, cite the relevant Contentstack doc set in PR descriptions rather than guessing CMS semantics.

.cursor/rules/typescript.mdc

@@ -0,0 +1,34 @@
+---
+description: TypeScript conventions for @contentstack/utils (src and tests)
+globs:
+  - src/**/*.ts
+  - __test__/**/*.ts
+alwaysApply: false
+---
+
+# TypeScript — `@contentstack/utils`
+
+## Tooling
+
+- **TypeScript ~4.9** (`package.json`, `tsconfig.json`).
+- **Bundler output:** `tsc` emits to `dist/lib` with declarations in `dist/types`; **Rollup** produces `dist/index.es.js` (`rollup.config.js`).
+- **Strict mode** is on with **`strictNullChecks: false`** — new code should still minimize unnecessary null/undefined gaps when touching APIs.
+
+## Layout
+
+- **Library code:** `src/**/*.ts` only (`tsconfig.json` `include`); **tests** are under `__test__/` (excluded from `tsc` program but type-checked via Jest/tsconfig paths).
+- **Public exports:** Maintain **`src/index.ts`** as the single export surface unless intentionally adding secondary entry points.
+
+## Style and lint
+
+- Match existing naming (PascalCase types, camelCase functions, existing file layout under `Models/`, `nodes/`, `helper/`, `options/`).
+- **ESLint** flat config: `eslint.config.js` — `@typescript-eslint` recommended for `__test__`; source files use `js.configs.recommended` baseline.
+- **Prettier:** `npm run format` scopes `src/**/*.ts`; keep formatting consistent when editing tests too.
+
+## JSON / assets
+
+- **`src/assets/regions.json`:** Consumed by `src/endpoints.ts`; populated by **`npm run download-regions`** during `prebuild`. Do not assume the file is committed (see root `.gitignore`).
+
+## Logging
+
+- No shared logger dependency; avoid introducing `console` noise in library paths unless consistent with nearby code.

.github/workflows/check-branch.yml

@@ -0,0 +1,20 @@
+name: 'Check Branch'
+
+on:
+  pull_request:
+
+jobs:
+  check_branch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Comment PR
+        if: github.base_ref == 'staging' && github.head_ref != 'development'
+        uses: thollander/actions-comment-pull-request@v2
+        with:
+          message: |
+            We regret to inform you that you are currently not able to merge your changes into the master branch due to restrictions applied by our SRE team. To proceed with merging your changes, we kindly request that you create a pull request from the development branch. Our team will then review the changes and work with you to ensure a successful merge into the master branch.
+      - name: Check branch
+        if: github.base_ref == 'staging' && github.head_ref != 'development'
+        run: |
+          echo "ERROR: We regret to inform you that you are currently not able to merge your changes into the master branch due to restrictions applied by our SRE team. To proceed with merging your changes, we kindly request that you create a pull request from the development branch. Our team will then review the changes and work with you to ensure a successful merge into the master branch."
+          exit 1

.github/workflows/ci.yml

@@ -1,22 +1,30 @@
-# This is a basic workflow to help you get started with Actions
-
 name: Unit-Test-CI
 
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the master branch
 on:
   push:
-    branches: [ master ]
+    branches: [ master, staging, development ]
   pull_request:
-    branches: [ master ]
+    branches: [ master, staging, development ]
 
 jobs:
-  build:
+  build-test:
     runs-on: ubuntu-latest
-    # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - uses: actions/checkout@v2
-      - name: Install modules
-        run: npm install
-      - name: Run tests
-        run: npm run test
+        - uses: actions/checkout@v3
+        - uses: ArtiomTr/jest-coverage-report-action@v2
+          id: coverage-utils-js
+          with:
+            output: comment, report-markdown
+        - uses: marocchino/sticky-pull-request-comment@v2
+          with:
+              header: Contentstack Utils JS Coverage
+              recreate: true
+              message: ${{ steps.coverage-utils-js.outputs.report }}
+        - name: Test Report
+          uses: dorny/test-reporter@v1
+          if: success() || failure()
+          with:
+            name: JEST Tests
+            path: reports/junit/jest-*.xml
+            reporter: jest-junit
+            fail-on-error: true

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,68 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: '*'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines. 
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #   echo "Run, Build Application using script"
+    #   ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2