# @nodable/entities

> Entity parser for XML, HTML, External entites with security and NCR control

Latest version **3.0.0** (published 2026-07-14) · MIT license · 0 weekly downloads

## Install

```sh
npm install @nodable/entities
pnpm add @nodable/entities
yarn add @nodable/entities
bun add @nodable/entities
```

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 3.0.0 |
| Published | 2026-07-14 |
| First published | 2026-04-14 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 0 |
| Unpacked size | 72.7 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 3 |
| Author | Amit Gupta |
| Maintainers | amitgupta |
| Keywords | fast, xml, html, entity, entities, stringify, encode, decode, ncr, security, safe, performance |

## Links

- npm: https://www.npmjs.com/package/@nodable/entities
- Repository: https://github.com/nodable/val-parsers
- Homepage: https://github.com/nodable/val-parsers#readme
- Issues: https://github.com/nodable/val-parsers/issues
- Funding: https://github.com/sponsors/nodable
- npm.io page: https://npm.io/package/@nodable/entities

## Alternatives

- [babylon](https://npm.io/package/babylon.md) — 5.1M weekly downloads
- [csscolorparser](https://npm.io/package/csscolorparser.md) — 3.7M weekly downloads
- [expr-eval-fork](https://npm.io/package/expr-eval-fork.md) — 1.5M weekly downloads
- [@leeoniya/ufuzzy](https://npm.io/package/@leeoniya/ufuzzy.md) — 247.7K weekly downloads
- [xml-parser](https://npm.io/package/xml-parser.md) — 78.4K weekly downloads

## Recent versions

- 3.0.0 (latest) — 2026-07-14
- 2.2.0 — 2026-06-12
- 2.1.1 — 2026-05-28
- 2.1.0 — 2026-04-16
- 2.0.0 — 2026-04-15
- 1.1.0 — 2026-04-14
- 1.0.1 — 2026-04-14
- 1.0.0 — 2026-04-14

## README

# @nodable/entities

Fast, zero-dependency XML/HTML entity encoder and decoder for Node.js.

## Install

```bash
npm install @nodable/entities
```

## Quick start

```js
import { EntityEncoder, EntityDecoder, ALL_ENTITIES } from '@nodable/entities';

// Encode: plain text → entity references
// v3 requires an explicit entity set when encoding named (non‑ASCII) characters
const enc = new EntityEncoder({ namedEntities: ALL_ENTITIES });
enc.encode('Hello © 2024 & <stuff>');
// → 'Hello &copy; 2024 &amp; &lt;stuff&gt;'

// Decode: entity references → plain text
const dec = new EntityDecoder({ namedEntities: ALL_ENTITIES });
dec.decode('Hello &copy; 2024 &amp; &lt;stuff&gt;');
// → 'Hello © 2024 & <stuff>'
```

If you only need to encode XML‑unsafe characters (`&`, `<`, `>`, `"`, `'`), you can disable named‑entity encoding entirely and avoid importing any entity set:

```js
const enc = new EntityEncoder({ encodeAllNamed: false });
enc.encode('© <stuff>'); // → '© &lt;stuff&gt;'  (copyright stays literal)
```

To encode only a specific subset of characters (e.g. common HTML entities), pass a custom map:

```js
import { EntityEncoder, COMMON_HTML, CURRENCY } from '@nodable/entities';

const enc = new EntityEncoder({ namedEntities: { ...COMMON_HTML, ...CURRENCY } });
enc.encode('Price: 10 © 2024'); // only COMMON_HTML/CURRENCY entities are recognized
```

---

## Migration from v2 to v3

**Breaking change:**  
In v2, `new EntityEncoder()` automatically used the full built‑in entity set to encode non‑ASCII characters (like `©` → `&copy;`). This caused poor tree‑shaking: every consumer paid the cost of the entire entity table, even if they never used it.

In v3, **`EntityEncoder` no longer includes a default entity set**.  
If you pass no options and `encodeAllNamed` is `true` (the default), the constructor will **throw an error**:

```js
const enc = new EntityEncoder(); // throws: "encodeAllNamed is true but no `namedEntities` was provided"
```

### How to update

| What you need | v2 code | v3 code |
|---------------|---------|---------|
| **Full built‑in set** (same as v2) | `new EntityEncoder()` | `import { ALL_ENTITIES } from '@nodable/entities';`<br>`new EntityEncoder({ namedEntities: ALL_ENTITIES })` |
| **Only XML‑unsafe chars** (no named entities) | `new EntityEncoder({ encodeAllNamed: false })` | **Same** – no change |
| **Custom subset** | `new EntityEncoder({ namedEntities: myMap })` | **Same** – but now your map is required for named‑entity encoding |

This change allows bundlers to tree‑shake unused entity categories – you only pay for the characters you actually encode.

### Upgrading step‑by‑step

1. Update to `@nodable/entities@3.0.0`.
2. Find all `new EntityEncoder()` calls in your project.
3. Decide:
   - If you need the full set: import `ALL_ENTITIES` and pass it as `namedEntities`.
   - If you only need XML‑unsafe escaping: add `{ encodeAllNamed: false }`.
   - If you used a custom set: keep it as‑is – it already worked.
4. Run your tests – the encoder should now behave as before, but with better bundle size.

## Performance

|  | encode | decode |
|---|---|---|
| `entities` (npm) | 3.65 M req/s | 1.76 M req/s |
| `@nodable/entities` | 3.33 M req/s | **5.19 M req/s** |

## Documentation

- [EntityEncoder](docs/EntityEncoder.md) — options, API, recipes
- [EntityDecoder](docs/EntityDecoder.md) — options, API, security limits, entity sets

## License

MIT

---
_Source: https://npm.io/package/@nodable/entities · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._