@ai-react-markdown/engine 2.4.2 → 2.4.3

package/dist/index.d.cts

@@ -764,34 +764,6 @@ interface ExtractContributionsOptions {
      *  Defs matching these are skipped to avoid leaking sentinel rows into
      *  registry.chunkData. */
     phantomFootnoteLabels?: Set<string>;
-    /**
-     * Caller's resolved URL transform (typically `props.urlTransform ??
-     * defaultUrlTransform`). Applied to every emitted `linkDef.url` so the
-     * registry stores already-sanitized URLs.
-     *
-     * Cross-chunk link/image references render through the registry rather
-     * than the in-tree hast (which is where react-markdown's transform pass
-     * normally enforces `urlTransform`). Without this, a chunk defining
-     * `[evil]: javascript:alert(1)` could XSS a sibling chunk that uses
-     * `[click][evil]` — the standalone path strips the protocol; the cross-
-     * chunk path would have rendered `<a href="javascript:…">`. Sanitizing at
-     * contribute time also benefits any future consumer that reads
-     * `Registry.resolveLinkDef` directly.
-     *
-     * Invocation contract mirrors react-markdown's hast-pass call site
-     * (`buildTransform` in `./markdown/transform.ts`): a synthetic
-     * `<a href={url}>` element stands in for the node argument since
-     * mdast `definition` nodes have no hast counterpart. The key is `'href'`
-     * — link defs are far more common than image defs, and protocol-allowlist
-     * transforms (including `defaultUrlTransform`) are key-agnostic anyway.
-     * A `null` return collapses to the empty string, matching how
-     * `transform.ts` would render a blocked attribute.
-     *
-     * Omitting this option preserves v1 behavior (URLs stored raw). Library
-     * callers should always supply it; the option stays optional so unit-test
-     * fixtures that don't care about URL safety can construct minimal calls.
-     */
-    urlTransform?: UrlTransform;
 }
 declare function extractContributions(mdast: Root, options?: ExtractContributionsOptions): Generator<Contribution>;
 
@@ -890,18 +862,15 @@ interface Registry {
     canonicalLinkFor(label: string): symbol | null;
     globalNumber(label: string): number | null;
     /**
-     * Resolve a cross-chunk link definition by label. The returned `url` is the
-     * value the contributing chunk's `urlTransform` produced — cross-chunk
-     * link/image references run a second, per-attribute sanitization pass
-     * (`urlTransform` + `sanitizeSchema.protocols`) at render time, so the
-     * placeholder components themselves never trust this value blindly.
+     * Resolve a cross-chunk link definition by label. The returned `url` is
+     * the RAW destination from the contributing chunk's source — the registry
+     * does not sanitize. The library's cross-chunk link/image placeholders run
+     * the full per-attribute sanitization (`sanitizeSchema.protocols` +
+     * `urlTransform`, correct key) at render time.
      *
      * Consumers reading `def.url` directly (custom backlink panels, analytics,
-     * dev tooling) receive a defense-in-depth-filtered string but should still
-     * pipe it through their own `urlTransform` if they intend to render it as
-     * an `href`/`src` — the contribute-time pass uses the `'href'` key and a
-     * synthetic `<a>` node, so a key-aware policy may treat the value
-     * differently when used as an `<img src>`.
+     * dev tooling) MUST run their own policy before rendering it as an
+     * `href`/`src` — a chunk can define `[evil]: javascript:alert(1)`.
      */
     resolveLinkDef(label: string): LinkDef | null;
     getRefsForLabel(label: string): number;
@@ -1692,7 +1661,11 @@ declare const sanitizeSchema: Schema;
  * and the trailing grapheme of the source is held back until it is
  * confirmed — by more text arriving or by `finish()` — so a surrogate
  * half or a still-growing emoji ZWJ sequence is never revealed to the
- * parser mid-cluster.
+ * parser mid-cluster. `snap()` (a replacement, or the very first `update`)
+ * is outside this promise by design: it shows the whole replacement text
+ * at once, trailing half-cluster included — a hold-back there would leave
+ * a controller that never drains when nothing follows (v2.4.2 review
+ * P3-1). Hosts that seed a stream mid-cluster get one frame of U+FFFD.
  *
  * @module components/smoothStream/controller
  */
@@ -1776,7 +1749,8 @@ interface SmoothStreamController {
      * a later {@link update} resumes animation.
      */
     finish(): void;
-    /** Jumps to `source` instantly, no animation, and clears any backlog. */
+    /** Jumps to `source` instantly, no animation, and clears any backlog.
+     *  No trailing-grapheme hold-back (see the module docs). */
     snap(source: string): void;
     /**
      * Reveals everything pending right now (skip-animation affordance). Keeps
@@ -1890,7 +1864,12 @@ interface Segment {
  * Split content into alternating text and protected segments.
  * Protected segments (isCode: true) are excluded from LaTeX processing:
  * - fenced multiline code blocks: 3+ backticks or tildes at the *start of a
- *   line* (≤3 space indent). Mid-line runs are never fence openers.
+ *   line* (any indentation — container-relative limits are not modelled).
+ *   Mid-line runs are never fence openers. INDENTED code blocks (4+ spaces
+ *   after a blank line, outside any container) are NOT modelled: without a
+ *   container model they cannot be told from a list item's continuation
+ *   paragraph, and protecting them would silence math in nested lists.
+ *   Known limitation — `$` inside an indented code block may be rewritten.
  * - inline code spans: a run of N backticks closed by another run of exactly
  *   N backticks. May span newlines. Multi-backtick forms (e.g. `` `` `x` ``)
  *   are supported so literal backtick characters can appear inside.

package/dist/index.d.ts

@@ -764,34 +764,6 @@ interface ExtractContributionsOptions {
      *  Defs matching these are skipped to avoid leaking sentinel rows into
      *  registry.chunkData. */
     phantomFootnoteLabels?: Set<string>;
-    /**
-     * Caller's resolved URL transform (typically `props.urlTransform ??
-     * defaultUrlTransform`). Applied to every emitted `linkDef.url` so the
-     * registry stores already-sanitized URLs.
-     *
-     * Cross-chunk link/image references render through the registry rather
-     * than the in-tree hast (which is where react-markdown's transform pass
-     * normally enforces `urlTransform`). Without this, a chunk defining
-     * `[evil]: javascript:alert(1)` could XSS a sibling chunk that uses
-     * `[click][evil]` — the standalone path strips the protocol; the cross-
-     * chunk path would have rendered `<a href="javascript:…">`. Sanitizing at
-     * contribute time also benefits any future consumer that reads
-     * `Registry.resolveLinkDef` directly.
-     *
-     * Invocation contract mirrors react-markdown's hast-pass call site
-     * (`buildTransform` in `./markdown/transform.ts`): a synthetic
-     * `<a href={url}>` element stands in for the node argument since
-     * mdast `definition` nodes have no hast counterpart. The key is `'href'`
-     * — link defs are far more common than image defs, and protocol-allowlist
-     * transforms (including `defaultUrlTransform`) are key-agnostic anyway.
-     * A `null` return collapses to the empty string, matching how
-     * `transform.ts` would render a blocked attribute.
-     *
-     * Omitting this option preserves v1 behavior (URLs stored raw). Library
-     * callers should always supply it; the option stays optional so unit-test
-     * fixtures that don't care about URL safety can construct minimal calls.
-     */
-    urlTransform?: UrlTransform;
 }
 declare function extractContributions(mdast: Root, options?: ExtractContributionsOptions): Generator<Contribution>;
 
@@ -890,18 +862,15 @@ interface Registry {
     canonicalLinkFor(label: string): symbol | null;
     globalNumber(label: string): number | null;
     /**
-     * Resolve a cross-chunk link definition by label. The returned `url` is the
-     * value the contributing chunk's `urlTransform` produced — cross-chunk
-     * link/image references run a second, per-attribute sanitization pass
-     * (`urlTransform` + `sanitizeSchema.protocols`) at render time, so the
-     * placeholder components themselves never trust this value blindly.
+     * Resolve a cross-chunk link definition by label. The returned `url` is
+     * the RAW destination from the contributing chunk's source — the registry
+     * does not sanitize. The library's cross-chunk link/image placeholders run
+     * the full per-attribute sanitization (`sanitizeSchema.protocols` +
+     * `urlTransform`, correct key) at render time.
      *
      * Consumers reading `def.url` directly (custom backlink panels, analytics,
-     * dev tooling) receive a defense-in-depth-filtered string but should still
-     * pipe it through their own `urlTransform` if they intend to render it as
-     * an `href`/`src` — the contribute-time pass uses the `'href'` key and a
-     * synthetic `<a>` node, so a key-aware policy may treat the value
-     * differently when used as an `<img src>`.
+     * dev tooling) MUST run their own policy before rendering it as an
+     * `href`/`src` — a chunk can define `[evil]: javascript:alert(1)`.
      */
     resolveLinkDef(label: string): LinkDef | null;
     getRefsForLabel(label: string): number;
@@ -1692,7 +1661,11 @@ declare const sanitizeSchema: Schema;
  * and the trailing grapheme of the source is held back until it is
  * confirmed — by more text arriving or by `finish()` — so a surrogate
  * half or a still-growing emoji ZWJ sequence is never revealed to the
- * parser mid-cluster.
+ * parser mid-cluster. `snap()` (a replacement, or the very first `update`)
+ * is outside this promise by design: it shows the whole replacement text
+ * at once, trailing half-cluster included — a hold-back there would leave
+ * a controller that never drains when nothing follows (v2.4.2 review
+ * P3-1). Hosts that seed a stream mid-cluster get one frame of U+FFFD.
  *
  * @module components/smoothStream/controller
  */
@@ -1776,7 +1749,8 @@ interface SmoothStreamController {
      * a later {@link update} resumes animation.
      */
     finish(): void;
-    /** Jumps to `source` instantly, no animation, and clears any backlog. */
+    /** Jumps to `source` instantly, no animation, and clears any backlog.
+     *  No trailing-grapheme hold-back (see the module docs). */
     snap(source: string): void;
     /**
      * Reveals everything pending right now (skip-animation affordance). Keeps
@@ -1890,7 +1864,12 @@ interface Segment {
  * Split content into alternating text and protected segments.
  * Protected segments (isCode: true) are excluded from LaTeX processing:
  * - fenced multiline code blocks: 3+ backticks or tildes at the *start of a
- *   line* (≤3 space indent). Mid-line runs are never fence openers.
+ *   line* (any indentation — container-relative limits are not modelled).
+ *   Mid-line runs are never fence openers. INDENTED code blocks (4+ spaces
+ *   after a blank line, outside any container) are NOT modelled: without a
+ *   container model they cannot be told from a list item's continuation
+ *   paragraph, and protecting them would silence math in nested lists.
+ *   Known limitation — `$` inside an indented code block may be rewritten.
  * - inline code spans: a run of N backticks closed by another run of exactly
  *   N backticks. May span newlines. Multi-backtick forms (e.g. `` `` `x` ``)
  *   are supported so literal backtick characters can appear inside.

package/dist/index.dev.cjs

@@ -1149,6 +1149,8 @@ function rebaseDualWalk(node, segments, maxEnd, offsetDelta, lineDelta) {
     for (const child of children) rebaseDualWalk(child, segments, maxEnd, offsetDelta, lineDelta);
   }
 }
+var TABLE_PART_TAG_RE = /<(?:td|th|tr|tbody|thead|tfoot|caption|col|colgroup)\b/i;
+var STRAY_SYNTHESIZED_END_TAG_RE = /<\/(?:br|p)\b/i;
 function spliceTrees(input) {
   const { prevMdast, prevHast, tailMdast, tailHast, content, boundary, injectionPrefix, injectedSegments } = input;
   const injectedLen = injectionPrefix.length;
@@ -1205,6 +1207,12 @@ function spliceTrees(input) {
     return !(start !== void 0 && start < injectedLen);
   });
   const tailWrapVisible = tailMdastChildren.some((child) => !isWrapInvisible(child));
+  if (prefixMdast.some((c) => c.type === "html" && TABLE_PART_TAG_RE.test(c.value))) return null;
+  for (const child of tailMdastChildren) {
+    if (isWrapInvisible(child)) continue;
+    if (child.type !== "html") break;
+    if (STRAY_SYNTHESIZED_END_TAG_RE.test(child.value) || TABLE_PART_TAG_RE.test(child.value)) return null;
+  }
   const aligned = alignPrefixCut(prefixMdast, cutRegion, tailWrapVisible);
   if (aligned === null) return null;
   const hastChildren = aligned.children;
@@ -1330,6 +1338,9 @@ function alignPrefixCut(prefixMdast, cutRegion, tailWrapVisible) {
     return null;
   }
   const lastIsLiteral = last !== void 0 && last.type === "text" && last.value.trim() !== "";
+  if (lastIsLiteral && pairIdx >= 0 && visibles[pairIdx].type !== "html") {
+    return null;
+  }
   const litOwnerEnd = pairIdx >= 0 ? visibles[pairIdx].position?.end?.offset : void 0;
   const litEnd = lastIsLiteral ? last.position?.end?.offset : void 0;
   if (lastIsLiteral && last.position !== void 0 && (litEnd === void 0 || litOwnerEnd === void 0)) {
@@ -1418,8 +1429,9 @@ function stripInjectedHast(tailMdast, tailHast, injectedLen, tailWrapVisible) {
 }
 function tailLeadingTextIsHoist(tailMdastChildren, tailHastChildren) {
   const firstText = tailHastChildren[0];
-  if (!firstText) return false;
   const firstVisible = tailMdastChildren.find((c) => !isWrapInvisible(c));
+  if (firstVisible?.type === "html" && STRAY_SYNTHESIZED_END_TAG_RE.test(firstVisible.value)) return null;
+  if (!firstText) return false;
   if (!isSeparatorText(firstText)) {
     if (firstText.type === "text" && firstText.position === void 0 && firstVisible?.type === "html") {
       if (/^\s*<\/[A-Za-z][A-Za-z0-9-]*\s*>/.test(firstVisible.value)) return true;
@@ -1860,17 +1872,8 @@ function phantomSuffixCloser(content) {
 }
 
 // src/components/extractContributions.ts
-function fakeAnchorElement(url) {
-  return { type: "element", tagName: "a", properties: { href: url }, children: [] };
-}
-function sanitizeDefUrl(url, urlTransform) {
-  if (!urlTransform) return url;
-  const result = urlTransform(url, "href", fakeAnchorElement(url));
-  return result == null ? "" : String(result);
-}
 function* extractContributions(mdast, options = {}) {
   const phantomFn = options.phantomFootnoteLabels;
-  const urlTransform = options.urlTransform;
   const out = [];
   (0, import_unist_util_visit3.visit)(mdast, (n) => {
     if (n.type === "footnoteReference") {
@@ -1898,7 +1901,7 @@ function* extractContributions(mdast, options = {}) {
       out.push({
         kind: "linkDef",
         label: normalizeId(d.identifier),
-        url: sanitizeDefUrl(d.url, urlTransform),
+        url: d.url,
         title: d.title
       });
     }
@@ -3612,8 +3615,7 @@ function isProtocolAllowed(url, allowed) {
 }
 function sanitizeCrossChunkUrl(rawUrl, key, tagName, urlTransform, schema) {
   rawUrl = (0, import_micromark_util_sanitize_uri2.normalizeUri)(rawUrl);
-  const callerProtocols = schema.protocols;
-  const allowed = callerProtocols === void 0 || callerProtocols === null ? sanitizeSchema.protocols?.[key] : callerProtocols[key];
+  const allowed = Object.hasOwn(schema, "protocols") ? schema.protocols?.[key] : sanitizeSchema.protocols?.[key];
   if (allowed && allowed.length > 0 && !isProtocolAllowed(rawUrl, allowed)) return null;
   const transformed = urlTransform(rawUrl, key, fakeElement(tagName, key, rawUrl));
   if (transformed == null) return null;
@@ -4023,15 +4025,14 @@ function lineHasBacktick(content, pos) {
   }
   return false;
 }
-function isAtLineStart(content, pos) {
+function lineIndentBefore(content, pos) {
   let i = pos - 1;
-  let spaces = 0;
-  while (i >= 0 && content[i] === " ") {
-    spaces++;
-    if (spaces > 3) return false;
+  let indent = 0;
+  while (i >= 0 && (content[i] === " " || content[i] === "	")) {
+    indent += content[i] === "	" ? 4 : 1;
     i--;
   }
-  return i < 0 || content[i] === "\n" || content[i] === "\r";
+  return i < 0 || content[i] === "\n" || content[i] === "\r" ? indent : -1;
 }
 function findClosingBacktickRun(content, start, n) {
   let i = start;
@@ -4052,6 +4053,7 @@ function splitByProtectedRegions(content) {
   let multilineStart = -1;
   let multilineFenceMarker = null;
   let multilineFenceLength = 0;
+  let multilineFenceIndent = 0;
   function pushProtected(start, end) {
     if (start > lastIndex) {
       segments.push({ text: content.substring(lastIndex, start), isCode: false });
@@ -4065,7 +4067,8 @@ function splitByProtectedRegions(content) {
     if (multilineStart !== -1) {
       if (char === multilineFenceMarker) {
         const runLen = getRepeatedMarkerLength(content, i, multilineFenceMarker);
-        if (runLen >= multilineFenceLength && isAtLineStart(content, i) && restOfLineIsBlank(content, i + runLen)) {
+        const closerIndent = lineIndentBefore(content, i);
+        if (runLen >= multilineFenceLength && closerIndent !== -1 && closerIndent <= multilineFenceIndent + 3 && restOfLineIsBlank(content, i + runLen)) {
           pushProtected(multilineStart, i + runLen);
           multilineStart = -1;
           multilineFenceMarker = null;
@@ -4081,10 +4084,12 @@ function splitByProtectedRegions(content) {
     }
     if (char === "`" || char === "~") {
       const runLen = getRepeatedMarkerLength(content, i, char);
-      if (runLen >= 3 && isAtLineStart(content, i) && !(char === "`" && lineHasBacktick(content, i + runLen))) {
+      const openerIndent = lineIndentBefore(content, i);
+      if (runLen >= 3 && openerIndent !== -1 && !(char === "`" && lineHasBacktick(content, i + runLen))) {
         multilineStart = i;
         multilineFenceMarker = char;
         multilineFenceLength = runLen;
+        multilineFenceIndent = openerIndent;
         i += runLen;
         continue;
       }