@ai-matrx/design-system 0.18.3 → 0.18.5

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.18.5
+
+Automatic changed-only republish (docs/metadata drift since the last tag — see
+`git diff npm/design-system/v0.18.4..npm/design-system/v0.18.5 -- apps/shared/design-system`).
+No source changes intended and no consumer action required.
+
+## 0.18.4 — 2026-09-12
+
+Alchemy custom exports now preserve the exact captured filename through
+preparation and delivery, with safe basename validation; omitting a filename
+keeps the existing default behavior. Tables gain the shared responsive
+`TableTitleRow`, canonical toolbar tooltips, a mobile-safe append footer, and
+collision-free Select labels and chevrons.
+
+### Consumer action
+
+Update to 0.18.4. No host configuration changes are required.
+
 ## 0.18.3 — 2026-09-12
 
 Reopening an Alchemy preparation now checks the current source while retaining

package/README.md

@@ -4,6 +4,28 @@ The small, semantic UI foundation shared by AI Matrx React applications — prim
 
 **Controls:** Button, Badge, Label, Separator, the Input family, the Textarea family, Checkbox, Switch, RadioGroup, Slider, Toggle + ToggleGroup, Avatar, Progress.
 **Content transfer:** `@ai-matrx/design-system/content-transfer` supplies Matrx Alchemy's inlined glyph, accessible menu, projected capture workspace, optional AI capability seam, and locally scoped `SurfaceHandle` provider. Its source is captured on user action; preparation keeps an immutable original, preserves manual and alternate-source sessions, fences stale async results, and routes every copy/download through `Transport`. Import `@ai-matrx/design-system/content-transfer.css` with the package structural sheets.
+
+```tsx
+<MatrxCopyMenu
+  label="Log"
+  export={{
+    items: [
+      {
+        id: "raw",
+        label: "Download raw log",
+        build: () => ({
+          content: rawText,
+          filename: "worker.log",
+          extension: "txt",
+          mime: "text/plain",
+        }),
+      },
+    ],
+  }}
+/>
+```
+
+An explicit filename is an exact safe basename captured with its bytes. Omit it to use the label-derived default; unsafe values fail the export visibly.
 **Surfaces:** Card, Table, Tabs, Accordion, Collapsible, ScrollArea, Popover, Tooltip, HoverCard, Sheet, Dialog, AlertDialog, Drawer, BottomSheet + TabbedBottomSheet, Alert, Resizable, Skeleton.
 **Menus:** DropdownMenu, ContextMenu, Command / CommandDialog, Select, CreatablePicker.
 **Composed:** EditableLabel, SegmentedControl, ArchiveFilter, ScoreRing, OverflowToolbar, ConfirmDialog + ConfirmDialogHost.

package/dist/content-transfer.cjs

@@ -649,6 +649,7 @@ var actionDone = (message) => ({
   mimeTypes: [],
   message
 });
+var isSafeFilename = (filename) => filename === filename.trim() && filename.length > 0 && !/^\.+$/.test(filename) && !/[\\/\x00-\x1F\x7F]/.test(filename);
 var sourceFor = (id, label, build) => ({
   id,
   label,
@@ -705,14 +706,21 @@ function MatrxCopyMenuSession(props) {
     ))
       throw new Error("Sheet rows must be JSON objects.");
     const rows = value;
-    const keys = [...new Set(rows.flatMap((row) => Object.keys(row)))];
+    const suppliedColumns = props.export.sheetColumns?.();
+    const columns = suppliedColumns ?? [...new Set(rows.flatMap((row) => Object.keys(row)))].map((id) => ({ id, label: id }));
+    const ids = /* @__PURE__ */ new Set();
+    for (const column of columns) {
+      if (!column.id || !column.label || ids.has(column.id)) throw new Error("Sheet columns require unique nonempty ids and labels.");
+      ids.add(column.id);
+    }
+    for (const row of rows) for (const key of Object.keys(row)) if (!ids.has(key)) throw new Error(`Sheet row key "${key}" is not declared in sheetColumns.`);
     return {
       kind: "rows",
       rows,
-      columns: keys.map((key) => ({
-        id: key,
-        label: key,
-        path: `/${key.replace(/~/g, "~0").replace(/\//g, "~1")}`,
+      columns: columns.map((column) => ({
+        id: column.id,
+        label: column.label,
+        path: `/${column.id.replace(/~/g, "~0").replace(/\//g, "~1")}`,
         visible: true
       }))
     };
@@ -797,7 +805,8 @@ function MatrxCopyMenuSession(props) {
                 value: {
                   bytes: Array.from(bytes),
                   mime: file.mime,
-                  extension: file.extension
+                  extension: file.extension,
+                  ...file.filename !== void 0 ? { filename: file.filename } : {}
                 }
               };
             },
@@ -814,12 +823,16 @@ function MatrxCopyMenuSession(props) {
             (byte) => typeof byte !== "number" || !Number.isInteger(byte) || byte < 0 || byte > 255
           ))
             throw new Error(`${item.label} did not capture a valid file.`);
+          if (value.filename !== void 0 && (typeof value.filename !== "string" || !isSafeFilename(value.filename)))
+            throw new Error(
+              `${item.label} has an unsafe filename. Use a nonempty basename without leading or trailing whitespace, dots only, path separators, or control characters.`
+            );
           if (draft.omissions.some((omission) => omission.reason !== "duplicate"))
             throw new Error(
               "This custom file exceeds the configured export limits or contains excluded content. Use a standard format or revise the source options."
             );
           const bytes = new Uint8Array(value.bytes);
-          const filename = `${props.label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "export"}.${value.extension.replace(/[^a-zA-Z0-9.-]/g, "") || "bin"}`;
+          const filename = typeof value.filename === "string" ? value.filename : `${props.label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "export"}.${value.extension.replace(/[^a-zA-Z0-9.-]/g, "") || "bin"}`;
           return transport.download(
             (0, import_content_transfer.sealTransferArtifact)({
               snapshotId: snapshot.id,