@ai-matrx/print 0.8.8 → 0.8.10

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.8.10
+### Unreleased
+
+- **Printed table cells read exactly as GFM reads them** (verify-RC-B4 R7-2):
+  tables are found and split BEFORE any inline pass, then each cell is read as
+  inline content — `\|` prints `|` inside code spans too, backslash escapes
+  resolve (`\\\\nas03\\fridge\\` prints `\\nas03\fridge\`, `C:\\temp` prints
+  `C:\temp`), code spans by the one code-range rule; a `> 8C | …` line after a
+  pipe-less table is a blockquote. Prose backslash escapes (`\*x\*`) print the
+  literal character in both skins. Judged against micromark + GFM over the
+  shared vectors (`src/markdown-tables-oracle.test.ts`); the verifier's
+  round-7 scripts live in `scripts/verifier-rcb4-round7/`.
+
+## 0.8.9
+### Unreleased
+
+- **New subpath `/markdown-html` — THE ONE Markdown→HTML engine** (Matrx
+  Alchemy CONTRACT §1.9, ALC-16). `createMarkdownHtmlEngine({ projectors })`
+  → `parse` (content-ir marks every kind island, each becomes an atom
+  placeholder, the `/document` parse runs once), `fragment` (skins
+  `document` / `article` / `inline`; profiles `generic` / `google-docs` /
+  `word`), `document`, `plainText` (tables as TSV, TeX kept as `$…$`). Every
+  string ends in the allow-list. Optional asset resolver for private images
+  (an unresolved image becomes its description with a notice).
+- **Security (LIST T26):** the display-math SVG the PDF writer draws is
+  allow-list sanitized (`MATH_SVG_SCHEMA`, `sanitizeMathSvg`) — TeX `\href`,
+  `\style`, `\class`, `\cssId`, `\bbox[…]`, `\mmlToken[…]` no longer reach it.
+- `/safe-html`: `engineHtmlSchema`, `sanitizeEngineHtml`.
+- `/document`: `documentToHtml` accepts `srcFor` and `transformBody`; an
+  image `srcFor` result now also passes the URL check (EPUB included).
+
+- **Tables print by THE GFM rule** (`@ai-matrx/content-ir/source`, verify-RC-B4):
+  tables written without edge pipes print as tables; an escaped `\|` stays in
+  its cell by backslash parity and prints as `|`; a line that starts another
+  block (`- x`, `> y`) ends a pipe-less table; rows print at the header's width.
+  The private `splitTableRow` and the pipe-led-only table regex are gone.
+  Requires `@ai-matrx/content-ir` with `/source` table exports.
+
 ## 0.8.8
 
 - **Security: every markdown→HTML path is allow-list sanitized.** The regex
@@ -608,3 +646,5 @@ originals die at the adoption swap):
   defaults; the template registry is now immutable; the dev-time geometry
   check no longer reads `process.env` bare (which would throw in browser
   consumers).
+
+

package/dist/document.cjs

@@ -368,6 +368,49 @@ var MATHML_SCHEMA = {
 function sanitizeMathml(mathml) {
   return sanitizeHtmlFragment(mathml, MATHML_SCHEMA);
 }
+var MATH_SVG_TAGS = ["svg", "g", "path", "rect", "line", "polyline", "polygon", "circle", "ellipse", "text", "title", "desc"];
+var MATH_SVG_ATTRIBUTES = [
+  "xmlns",
+  "width",
+  "height",
+  "viewBox",
+  "role",
+  "focusable",
+  "ariaHidden",
+  "ariaLabel",
+  "stroke",
+  "fill",
+  "strokeWidth",
+  "strokeLinecap",
+  "strokeLinejoin",
+  "transform",
+  "d",
+  "x",
+  "y",
+  "x1",
+  "y1",
+  "x2",
+  "y2",
+  "points",
+  "cx",
+  "cy",
+  "r",
+  "rx",
+  "ry",
+  "dataMmlNode",
+  "dataC"
+];
+var MATH_SVG_SCHEMA = {
+  tagNames: MATH_SVG_TAGS,
+  attributes: { "*": MATH_SVG_ATTRIBUTES },
+  strip: ["script", "style", "foreignObject"],
+  clobberPrefix: "",
+  clobber: [],
+  protocols: {}
+};
+function sanitizeMathSvg(svg) {
+  return sanitizeHtmlFragment(svg, MATH_SVG_SCHEMA);
+}
 
 // src/document/math.ts
 var MATH_OPEN = "\uE100";
@@ -441,7 +484,7 @@ async function typesetMathSpans(spans) {
       }
       const entry = { mathml: sanitizeMathml(mathml.replace(/\n\s*/g, "")) };
       if (s.display) {
-        const svg = mj.svg(s.tex, true);
+        const svg = sanitizeMathSvg(mj.svg(s.tex, true));
         entry.svg = svg;
         entry.widthEx = Number(/width="([\d.]+)ex"/.exec(svg)?.[1] ?? 0);
         entry.heightEx = Number(/height="([\d.]+)ex"/.exec(svg)?.[1] ?? 0);
@@ -3551,7 +3594,10 @@ function mathHtml(tex, display, x, inText = false) {
 }
 var href = (id, x) => x.hrefFor ? x.hrefFor(id) : `#${id}`;
 function imageSrc(url, x) {
-  if (x.srcFor) return x.srcFor(url);
+  if (x.srcFor) {
+    const src = x.srcFor(url);
+    return src === null ? null : safeUrl(src);
+  }
   const resolved = x.images?.get(url);
   if (resolved) return resolved.dataUrl;
   return safeUrl(url);
@@ -3732,7 +3778,7 @@ ${[2, 3, 4, 5, 6].map((l) => `.doc-toc .toc-l${l}{padding-left:${(l - 1) * 1.2}e
 }
 function documentToHtml(tree, options = {}) {
   const s = tree.settings;
-  const x = { tree, images: options.images };
+  const x = { tree, images: options.images, ...options.srcFor ? { srcFor: options.srcFor } : {} };
   const sections = tree.sections.map((sec) => {
     const cls = [
       "doc-section",
@@ -3755,8 +3801,8 @@ ${s.author ? `<meta name="author" content="${(0, import_html_escape.escapeHtml)(
 </head>
 <body>
 <main class="doc">
-${s.cover ? coverHtml(s, x) : ""}
-${sections}
+${(options.transformBody ?? ((h) => h))(`${s.cover ? coverHtml(s, x) : ""}
+${sections}`)}
 </main>
 </body>
 </html>`;
@@ -5095,6 +5141,7 @@ var import_micromark_extension_gfm = require("micromark-extension-gfm");
 
 // src/markdown.ts
 var import_html_escape3 = require("@ai-matrx/kit/html-escape");
+var import_source2 = require("@ai-matrx/content-ir/source");
 function removeThinkingContent(content) {
   if (!content) return "";
   const hide = (_match, before, after) => before.length >= 2 || after.length >= 2 ? "\n\n" : "\n";