@ismail-elkorchi/xml-parser

Deterministic XML parsing and utility APIs for automation across Node, Deno, Bun, and browser smoke paths.

No runtime dependencies: this package ships with zero runtime dependencies.

When To Use

• You need deterministic XML parse and serialization behavior.
• You need explicit budget controls for untrusted XML.
• You need canonicalization, hashing, and replay utilities in one package.

When Not To Use

• You need a full XSD engine integrated into parse-time behavior.
• You need browser DOM runtime APIs.
• You need permissive DTD/external-entity processing.

Install

npm install @ismail-elkorchi/xml-parser

deno add jsr:@ismail-elkorchi/xml-parser

Import

import { parseXml } from "@ismail-elkorchi/xml-parser";

import { parseXml } from "jsr:@ismail-elkorchi/xml-parser";

Copy/Paste Examples

Example 1: Parse XML

import { parseXml } from "@ismail-elkorchi/xml-parser";

const document = parseXml("<root><item/></root>");
console.log(document.kind);

Example 2: Parse streaming XML

import { parseXmlStream } from "@ismail-elkorchi/xml-parser";

const stream = new ReadableStream({
  start(controller) {
    controller.enqueue(new TextEncoder().encode("<root><item/></root>"));
    controller.close();
  }
});

const document = await parseXmlStream(stream, { budgets: { maxStreamBytes: 4096 } });
console.log(document.kind);

Example 3: Query XML elements

import { listElementsByQName, parseXml } from "@ismail-elkorchi/xml-parser";

const document = parseXml("<root><item/><item/></root>");
console.log(listElementsByQName(document, "item").length);

Example 4: Validate profile

import { parseXml, validateXmlProfile } from "@ismail-elkorchi/xml-parser";

const document = parseXml("<invoice><line/></invoice>");
console.log(validateXmlProfile(document, { expectedRootQName: "invoice", requiredElementQNames: ["line"] }).ok);

Run packaged examples:

npm run examples:run

Compatibility

Runtime compatibility matrix:

| Runtime | Status | | --- | --- | | Node.js | Supported | | Deno | Supported | | Bun | Supported | | Browser (evergreen) | Supported |

Security and Safety Notes

XML parsing is not a trust boundary by itself.

• Keep strict mode enabled.
• Configure parse budgets for untrusted input.
• Validate and sanitize at the application boundary.

Documentation

• Docs index
• First parse success tutorial
• Options reference