@ai-matrx/design-system 0.18.3 → 0.18.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.18.4 — 2026-09-12
+
+Alchemy custom exports now preserve the exact captured filename through
+preparation and delivery, with safe basename validation; omitting a filename
+keeps the existing default behavior. Tables gain the shared responsive
+`TableTitleRow`, canonical toolbar tooltips, a mobile-safe append footer, and
+collision-free Select labels and chevrons.
+
+### Consumer action
+
+Update to 0.18.4. No host configuration changes are required.
+
 ## 0.18.3 — 2026-09-12
 
 Reopening an Alchemy preparation now checks the current source while retaining

package/README.md

@@ -4,6 +4,28 @@ The small, semantic UI foundation shared by AI Matrx React applications — prim
 
 **Controls:** Button, Badge, Label, Separator, the Input family, the Textarea family, Checkbox, Switch, RadioGroup, Slider, Toggle + ToggleGroup, Avatar, Progress.
 **Content transfer:** `@ai-matrx/design-system/content-transfer` supplies Matrx Alchemy's inlined glyph, accessible menu, projected capture workspace, optional AI capability seam, and locally scoped `SurfaceHandle` provider. Its source is captured on user action; preparation keeps an immutable original, preserves manual and alternate-source sessions, fences stale async results, and routes every copy/download through `Transport`. Import `@ai-matrx/design-system/content-transfer.css` with the package structural sheets.
+
+```tsx
+<MatrxCopyMenu
+  label="Log"
+  export={{
+    items: [
+      {
+        id: "raw",
+        label: "Download raw log",
+        build: () => ({
+          content: rawText,
+          filename: "worker.log",
+          extension: "txt",
+          mime: "text/plain",
+        }),
+      },
+    ],
+  }}
+/>
+```
+
+An explicit filename is an exact safe basename captured with its bytes. Omit it to use the label-derived default; unsafe values fail the export visibly.
 **Surfaces:** Card, Table, Tabs, Accordion, Collapsible, ScrollArea, Popover, Tooltip, HoverCard, Sheet, Dialog, AlertDialog, Drawer, BottomSheet + TabbedBottomSheet, Alert, Resizable, Skeleton.
 **Menus:** DropdownMenu, ContextMenu, Command / CommandDialog, Select, CreatablePicker.
 **Composed:** EditableLabel, SegmentedControl, ArchiveFilter, ScoreRing, OverflowToolbar, ConfirmDialog + ConfirmDialogHost.

package/dist/content-transfer.cjs

@@ -649,6 +649,7 @@ var actionDone = (message) => ({
   mimeTypes: [],
   message
 });
+var isSafeFilename = (filename) => filename === filename.trim() && filename.length > 0 && !/^\.+$/.test(filename) && !/[\\/\x00-\x1F\x7F]/.test(filename);
 var sourceFor = (id, label, build) => ({
   id,
   label,
@@ -797,7 +798,8 @@ function MatrxCopyMenuSession(props) {
                 value: {
                   bytes: Array.from(bytes),
                   mime: file.mime,
-                  extension: file.extension
+                  extension: file.extension,
+                  ...file.filename !== void 0 ? { filename: file.filename } : {}
                 }
               };
             },
@@ -814,12 +816,16 @@ function MatrxCopyMenuSession(props) {
             (byte) => typeof byte !== "number" || !Number.isInteger(byte) || byte < 0 || byte > 255
           ))
             throw new Error(`${item.label} did not capture a valid file.`);
+          if (value.filename !== void 0 && (typeof value.filename !== "string" || !isSafeFilename(value.filename)))
+            throw new Error(
+              `${item.label} has an unsafe filename. Use a nonempty basename without leading or trailing whitespace, dots only, path separators, or control characters.`
+            );
           if (draft.omissions.some((omission) => omission.reason !== "duplicate"))
             throw new Error(
               "This custom file exceeds the configured export limits or contains excluded content. Use a standard format or revise the source options."
             );
           const bytes = new Uint8Array(value.bytes);
-          const filename = `${props.label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "export"}.${value.extension.replace(/[^a-zA-Z0-9.-]/g, "") || "bin"}`;
+          const filename = typeof value.filename === "string" ? value.filename : `${props.label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "export"}.${value.extension.replace(/[^a-zA-Z0-9.-]/g, "") || "bin"}`;
           return transport.download(
             (0, import_content_transfer.sealTransferArtifact)({
               snapshotId: snapshot.id,