@geml/geml 1.0.0 → 1.3.2

package/dist/history.d.ts

@@ -15,6 +15,7 @@ interface Revision {
     author?: string;
     summary?: string;
     hash: string;
+    newline?: string;
     ops: Op[];
 }
 interface History {
@@ -52,4 +53,33 @@ export interface RestoreOpts {
     force?: boolean;
 }
 export declare function restore(o: RestoreOpts): string;
+export interface RevisionInfo {
+    id: string;
+    parent?: string;
+    author?: string;
+    summary?: string;
+    hash: string;
+    offset: number;
+    current: boolean;
+}
+/** Is the working file byte-identical to the sidecar's tip revision? False
+ *  means uncommitted drift (e.g. an earlier commit attempt was refused). */
+export declare function isCurrent(historyPath: string, gemlPath: string): boolean;
+/** Revisions newest-first, each tagged with the `-N` offset that selects it. */
+export declare function listRevisions(historyPath: string): RevisionInfo[];
+/** Resolve a revision selector to its id + reconstructed full text. Selectors:
+ *  `-N` (N revisions back from current; `-0` is the tip), `latest`/`current`, or
+ *  an unambiguous id prefix/suffix (the same forms `restore` accepts). */
+export declare function resolveContent(historyPath: string, selector: string): {
+    id: string;
+    text: string;
+};
+/** Walk the chain newest→oldest; return the first revision whose block (as
+ *  extracted by `pick`) differs from `currentBlock` — i.e. the block's previous
+ *  *distinct* version, skipping revisions that never touched it. Used by
+ *  `revert --changed`. `undefined` if no earlier revision changed the block. */
+export declare function firstChangedContent(historyPath: string, currentBlock: string, pick: (fullText: string) => string | undefined): {
+    id: string;
+    text: string;
+} | undefined;
 export {};

package/dist/history.js

@@ -80,9 +80,12 @@ function fenceFor(contentLf) {
 // ---------------------------------------------------------------------------
 // Document units & reverse-patch engine (gap-aware)
 // ---------------------------------------------------------------------------
-// Unit-key = `#id` (explicit), or `@<8hex content hash>` (derived) with `~n`
-// disambiguating equal-content units by document-order occurrence (§4).
-const KEY = String.raw `(#[A-Za-z][A-Za-z0-9_-]*|@[0-9a-f]+(?:~\d+)?)`;
+// Unit-key = `#id` (explicit), or `@<8hex content hash>` (derived), with `~n`
+// disambiguating equal keys by document-order occurrence (§4). `~n` on an #id
+// key only arises for OUT-OF-SPEC documents that repeat an id — without it the
+// key is ambiguous, reverse-patch ops hit the wrong occurrence, and commit()'s
+// round-trip gate (correctly) aborts. Well-formed documents never emit it.
+const KEY = String.raw `(#[A-Za-z][A-Za-z0-9_-]*(?:~\d+)?|@[0-9a-f]+(?:~\d+)?)`;
 function sha8(s) {
     return createHash("sha256").update(Buffer.from(s, "utf8")).digest("hex").slice(0, 8);
 }
@@ -127,9 +130,11 @@ function tile(lines) {
 function keyedUnits(lines) {
     const counts = new Map();
     return tile(lines).map((u) => {
-        if (u.id)
-            return { u, key: `#${u.id}` };
-        const base = `@${sha8(lines.slice(u.start, u.bodyEnd).join("\n"))}`;
+        // Both key kinds get the ~n occurrence suffix: content keys collide by
+        // nature (equal blank runs, repeated paragraphs); #id keys only collide in
+        // out-of-spec documents that repeat an id — but those exist in the wild,
+        // and an ambiguous key sends reverse-patch ops to the wrong occurrence.
+        const base = u.id ? `#${u.id}` : `@${sha8(lines.slice(u.start, u.bodyEnd).join("\n"))}`;
         const n = counts.get(base) ?? 0;
         counts.set(base, n + 1);
         return { u, key: n === 0 ? base : `${base}~${n}` };
@@ -200,16 +205,46 @@ function applyReverse(textLf, ops, blobs) {
             throw new Error(`history: unresolved blob:${id}`);
         return p.split("\n");
     };
+    // `delete`/`replace` name units in the INPUT document (v_new) — their `~n`
+    // occurrence suffixes are numbered over the whole of v_new. So resolve them
+    // against ONE snapshot of the unmutated input, not the live array: re-keying
+    // per op lets an earlier delete renumber a later op's occurrence (delete @h
+    // then delete @h~1 — after the first splice the survivor renumbers @h~1→@h
+    // and the second op can no longer find it). Keys are unique within a single
+    // keyedUnits() call, so the snapshot map is a bijection.
+    const snap = keyedUnits(lines);
+    const byKey = new Map(snap.map((k) => [k.key, k.u]));
+    const resolveSnap = (key) => {
+        const u = byKey.get(key);
+        if (!u)
+            throw new Error(`history: unit ${key} not found while applying reverse patch`);
+        return u;
+    };
+    const rangeEdits = [];
+    const anchored = []; // insert / move — resolved against the LIVE array below
     for (const op of ops) {
         if (op.kind === "delete") {
-            const u = locateUnit(lines, op.key);
-            lines.splice(u.start, u.endExcl - u.start);
+            const u = resolveSnap(op.key);
+            rangeEdits.push({ start: u.start, endExcl: u.endExcl, repl: [] });
         }
         else if (op.kind === "replace") {
-            const u = locateUnit(lines, op.key);
-            lines.splice(u.start, u.endExcl - u.start, ...blob(op.blob));
+            const u = resolveSnap(op.key);
+            rangeEdits.push({ start: u.start, endExcl: u.endExcl, repl: blob(op.blob) });
         }
-        else if (op.kind === "insert") {
+        else {
+            anchored.push(op);
+        }
+    }
+    rangeEdits.sort((a, b) => b.start - a.start);
+    for (const e of rangeEdits)
+        lines.splice(e.start, e.endExcl - e.start, ...e.repl);
+    // Inserts (and moves) run only after every delete/replace, so the array is
+    // already in its reconstructed (v_parent) shape: an insert's anchor names a
+    // v_parent unit, and chained inserts build on units added just before them —
+    // both need LIVE re-keying, which is correct here precisely because the
+    // occurrence keying is now stable (no more same-keyspace ops pending).
+    for (const op of anchored) {
+        if (op.kind === "insert") {
             insertAt(lines, op.anchor, blob(op.blob));
         }
         else { // move: cut the unit (with its owned blanks) and re-insert at anchor
@@ -221,25 +256,51 @@ function applyReverse(textLf, ops, blobs) {
     }
     return lines.join("\n");
 }
-/** LCS alignment of unit-key sequences; aMatch[i] = matched index in b, or -1. */
+/** LCS alignment of unit-key sequences; aMatch[i] = matched index in b, or -1.
+ *
+ * keyedUnits() assigns keys that are unique WITHIN each sequence (the `~n`
+ * occurrence suffix disambiguates equal content / repeated ids), so both `a`
+ * and `b` are all-unique. The LCS of two all-unique sequences is exactly the
+ * longest increasing subsequence of a's keys mapped to b's positions:
+ * O(n log n) instead of an O(n·m) DP table — GEP-0002's measured bottleneck
+ * (seconds at 10⁴ units, minutes at 10⁵; code-graph documents live there).
+ *
+ * If keys were ever non-unique (no public entry point produces that — the only
+ * caller, diffReverse, feeds keyedUnits output), posInB keeps b's LAST index
+ * per key and the LIS still yields *a* valid monotonic matching; commit()'s
+ * byte-exact round-trip gate rejects any diff that fails to reproduce the
+ * parent regardless. */
 function lcsMatch(a, b) {
     const n = a.length, m = b.length;
-    const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
-    for (let i = n - 1; i >= 0; i--)
-        for (let j = m - 1; j >= 0; j--)
-            dp[i][j] = a[i] === b[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
     const aMatch = new Array(n).fill(-1);
-    let i = 0, j = 0;
-    while (i < n && j < m) {
-        if (a[i] === b[j]) {
-            aMatch[i] = j;
-            i++;
-            j++;
+    const posInB = new Map();
+    for (let j = 0; j < m; j++)
+        posInB.set(b[j], j);
+    const ai = [], bj = []; // a-index / b-position of common keys, in a-order
+    for (let i = 0; i < n; i++) {
+        const j = posInB.get(a[i]);
+        if (j !== undefined) {
+            ai.push(i);
+            bj.push(j);
         }
-        else if (dp[i + 1][j] >= dp[i][j + 1])
-            i++;
-        else
-            j++;
+    }
+    // Patience LIS over bj (strictly increasing) with predecessor links.
+    const tails = []; // index into bj of the smallest tail per LIS length
+    const prev = new Array(bj.length).fill(-1);
+    for (let x = 0; x < bj.length; x++) {
+        let lo = 0, hi = tails.length;
+        while (lo < hi) {
+            const mid = (lo + hi) >> 1;
+            if (bj[tails[mid]] < bj[x])
+                lo = mid + 1;
+            else
+                hi = mid;
+        }
+        prev[x] = lo > 0 ? tails[lo - 1] : -1;
+        tails[lo] = x;
+    }
+    for (let cur = tails.length ? tails[tails.length - 1] : -1; cur >= 0; cur = prev[cur]) {
+        aMatch[ai[cur]] = bj[cur];
     }
     return aMatch;
 }
@@ -289,6 +350,22 @@ function opLine(op) {
         return `insert <- blob:${op.blob} ${anchorStr(op.anchor)}`;
     return `move ${op.key} ${anchorStr(op.anchor)}`;
 }
+// §8 hashes are over "the exact UTF-8 bytes of that version" — which includes
+// its newline style. The sidecar's file-level nl is a SINGLE value that later
+// commits overwrite, so a document whose line endings flipped (LF↔CRLF is
+// routine on Windows) would leave older revisions' recorded hashes
+// unreproducible. Each revision therefore records its own `newline`; for
+// legacy revisions that never recorded one, accept either byte encoding of
+// the reconstructed text — both still pin the CONTENT exactly.
+const nlNamed = (nl) => (nl === "\r\n" ? "crlf" : "lf");
+const nlOf = (name) => name === "crlf" ? "\r\n" : name === "lf" ? "\n" : undefined;
+function hashMatchesRecorded(lf, r, fileNl) {
+    const own = nlOf(r.newline);
+    if (own)
+        return fullHash(lf, own) === r.hash;
+    return fullHash(lf, fileNl) === r.hash
+        || fullHash(lf, fileNl === "\r\n" ? "\n" : "\r\n") === r.hash;
+}
 function parseHistory(path) {
     const { lf, nl } = loadBytes(path);
     const lines = lf.split("\n");
@@ -315,6 +392,7 @@ function parseHistory(path) {
                 author: attr(b.attrLine, "author"),
                 summary: attr(b.attrLine, "summary"),
                 hash: attr(b.attrLine, "hash") ?? "",
+                newline: attr(b.attrLine, "newline"),
                 ops: parseOps(body),
             });
         }
@@ -386,6 +464,7 @@ function renderHistory(h, baseName) {
             r.author ? `author="${r.author}"` : "",
             r.summary ? `summary="${r.summary}"` : "",
             `hash="${r.hash}"`,
+            r.newline ? `newline="${r.newline}"` : "",
         ].filter(Boolean).join(" ");
         parts.push(`=== revision {${at}}\n${r.ops.map(opLine).join("\n")}${r.ops.length ? "\n" : ""}===\n`);
         // blobs referenced by this revision
@@ -417,9 +496,23 @@ export function commit(o) {
         if (bytesOf(back, nl).compare(bytesOf(prevContent, nl)) !== 0) {
             throw new Error("history: reverse patch does NOT round-trip to the previous revision; aborting commit");
         }
+        // Blob ids are minted per-diff (b1, b2, …). Renumber this commit's blobs to
+        // start past the highest id already stored, so a later commit never reuses
+        // an earlier revision's blob id — an overwrite in the shared store silently
+        // corrupts reconstruction of older revisions, whose `replace … <- blob:bN`
+        // would then resolve to the wrong (newer) content.
+        let maxBlob = 0;
+        for (const k of h.blobs.keys()) {
+            const mm = /^b(\d+)$/.exec(k);
+            if (mm)
+                maxBlob = Math.max(maxBlob, Number(mm[1]));
+        }
+        const remap = new Map(patch.blobs.map((b, i) => [b.id, `b${maxBlob + i + 1}`]));
+        patch.ops = patch.ops.map((op) => (op.blob ? { ...op, blob: remap.get(op.blob) } : op));
+        patch.blobs = patch.blobs.map((b) => ({ id: remap.get(b.id), payload: b.payload }));
         for (const b of patch.blobs)
             h.blobs.set(b.id, b.payload);
-        h.revisions.set(id, { id, parent: prevId, author: o.author, summary: o.summary, hash, ops: patch.ops });
+        h.revisions.set(id, { id, parent: prevId, author: o.author, summary: o.summary, hash, newline: nlNamed(nl), ops: patch.ops });
         h.keyframes.delete(prevId); // demote previous tip mirror (keyframes at intervals only)
         h.keyframes.set(id, working);
         h.current = id;
@@ -428,7 +521,7 @@ export function commit(o) {
         h = {
             nl, current: id,
             keyframes: new Map([[id, working]]),
-            revisions: new Map([[id, { id, author: o.author, summary: o.summary, hash, ops: [] }]]),
+            revisions: new Map([[id, { id, author: o.author, summary: o.summary, hash, newline: nlNamed(nl), ops: [] }]]),
             blobs: new Map(),
         };
     }
@@ -447,17 +540,46 @@ export function verify(historyPath, gemlPath) {
     catch (e) {
         errors.push(String(e.message));
     }
+    // Reconstruct every revision INCREMENTALLY. `reconstruct(h, id)` on its own
+    // rebuilds each revision from the nearest keyframe, replaying up to O(N) ops
+    // each time; calling it once per revision is therefore O(N²·K) and lets a
+    // ~91 KB sidecar take ~a minute. Because the chain runs newest->oldest and
+    // (for revisions without their own keyframe) nearest-keyframe(i) is always
+    // nearest-keyframe(i-1), reconstruct(chain[i]) == applyReverse(reconstruct(
+    // chain[i-1]), chain[i-1].ops). So we carry the previous revision's content
+    // forward and apply ONE reverse patch per step — O(N·K) overall — while
+    // validating the exact same reconstructed bytes for every revision. Whenever
+    // that carried base is not trustworthy (a keyframe-less head, or right after
+    // a step threw) we fall back to the full `reconstruct`, which reproduces the
+    // original's behaviour and error messages verbatim.
+    let prevContent = null;
+    let prevOps = null;
+    let baseValid = false;
     for (const r of chain) {
         try {
-            const content = reconstruct(h, r.id);
-            const got = fullHash(content, h.nl);
-            if (got !== r.hash)
-                errors.push(`revision ${r.id}: reconstructed hash ${got} != recorded ${r.hash}`);
+            let content;
+            if (h.keyframes.has(r.id)) {
+                content = h.keyframes.get(r.id);
+            }
+            else if (baseValid && prevContent !== null && prevOps !== null) {
+                content = applyReverse(prevContent, prevOps, h.blobs);
+            }
+            else {
+                content = reconstruct(h, r.id);
+            }
+            if (!hashMatchesRecorded(content, r, h.nl)) {
+                errors.push(`revision ${r.id}: reconstructed hash ${fullHash(content, nlOf(r.newline) ?? h.nl)} != recorded ${r.hash}`);
+            }
+            prevContent = content;
+            baseValid = true;
             checked++;
         }
         catch (e) {
             errors.push(`revision ${r.id}: ${e.message}`);
+            prevContent = null;
+            baseValid = false; // a failed step is not a valid base for the next
         }
+        prevOps = r.ops;
     }
     if (gemlPath && existsSync(gemlPath)) {
         const { lf, nl } = loadBytes(gemlPath);
@@ -505,3 +627,61 @@ export function restore(o) {
     }
     return content;
 }
+/** Is the working file byte-identical to the sidecar's tip revision? False
+ *  means uncommitted drift (e.g. an earlier commit attempt was refused). */
+export function isCurrent(historyPath, gemlPath) {
+    const h = parseHistory(historyPath);
+    const tip = h.revisions.get(h.current);
+    if (!tip)
+        return false;
+    const { lf, nl } = loadBytes(gemlPath);
+    return fullHash(lf, nl) === tip.hash;
+}
+/** Revisions newest-first, each tagged with the `-N` offset that selects it. */
+export function listRevisions(historyPath) {
+    const h = parseHistory(historyPath);
+    return chainFrom(h).map((r, i) => ({
+        id: r.id, parent: r.parent, author: r.author, summary: r.summary, hash: r.hash,
+        offset: i, current: i === 0,
+    }));
+}
+/** Resolve a revision selector to its id + reconstructed full text. Selectors:
+ *  `-N` (N revisions back from current; `-0` is the tip), `latest`/`current`, or
+ *  an unambiguous id prefix/suffix (the same forms `restore` accepts). */
+export function resolveContent(historyPath, selector) {
+    const h = parseHistory(historyPath);
+    const chain = chainFrom(h); // chain[0] = current tip
+    let id;
+    const off = /^-(\d+)$/.exec(selector);
+    if (off) {
+        const n = Number(off[1]);
+        if (n >= chain.length)
+            throw new Error(`history: offset -${n} is out of range (only ${chain.length} revision(s))`);
+        id = chain[n].id;
+    }
+    else if (selector === "latest" || selector === "current") {
+        id = chain[0].id;
+    }
+    else {
+        const ids = [...h.revisions.keys()];
+        const matches = ids.filter((x) => x === selector || x.startsWith(selector) || x.endsWith(selector));
+        if (matches.length !== 1)
+            throw new Error(`history: revision selector "${selector}" matched ${matches.length} revisions`);
+        id = matches[0];
+    }
+    return { id, text: reconstruct(h, id) };
+}
+/** Walk the chain newest→oldest; return the first revision whose block (as
+ *  extracted by `pick`) differs from `currentBlock` — i.e. the block's previous
+ *  *distinct* version, skipping revisions that never touched it. Used by
+ *  `revert --changed`. `undefined` if no earlier revision changed the block. */
+export function firstChangedContent(historyPath, currentBlock, pick) {
+    const h = parseHistory(historyPath);
+    for (const r of chainFrom(h)) {
+        const text = reconstruct(h, r.id);
+        const b = pick(text);
+        if (b !== undefined && b !== currentBlock)
+            return { id: r.id, text };
+    }
+    return undefined;
+}

package/dist/inline.d.ts

@@ -49,4 +49,5 @@ export interface Ref {
 export interface RefSink {
     refs: Ref[];
 }
-export declare function parseInline(s: string, line: number, sink: RefSink): Inline[];
+export declare const META_REF_SRC = "\\{\\{\\s*([A-Za-z_][A-Za-z0-9_-]*)\\s*\\}\\}";
+export declare function parseInline(s: string, line: number, sink: RefSink, depth?: number): Inline[];

package/dist/inline.js

@@ -6,7 +6,41 @@
 // internal/cross-document reference is reported to a `RefSink` so the document
 // layer can resolve and validate it at build time (§8).
 import { parseAttrs } from "./attrs.js";
-const SCHEME = /^[a-z][a-z0-9+.-]*:/i; // http:, https:, mailto:, …
+const MAX_INLINE_NESTING = 100; // cap parseInline<->scanAtoms recursion (R2-7 DoS)
+// §4: the source pattern of a `{{key}}` metadata reference. Owned here as the
+// single definition of what a reference looks like — the parser substitutes it
+// (geml.ts), the serializer escapes it on emit (serialize.ts), and the md
+// converter escapes it on conversion (from-md.ts). Build flagged variants with
+// `new RegExp(META_REF_SRC, flags)`.
+export const META_REF_SRC = "\\{\\{\\s*([A-Za-z_][A-Za-z0-9_-]*)\\s*\\}\\}";
+// §5: URL schemes that may be emitted as an href/src. A destination that names
+// any other scheme (javascript:, vbscript:, data:text/html, file:, …) is a
+// script-injection / local-read vector at the HTML sink, so it is neutralized
+// here at the parse layer — every consumer of the model inherits the guard.
+const SAFE_SCHEMES = new Set(["http", "https", "mailto", "tel"]);
+// The leading `scheme:` (RFC-3986 grammar), lowercased — or null when the
+// destination has none (a relative path, `#anchor`, or cross-document ref).
+function schemeOf(url) {
+    // Browsers strip leading/embedded C0 controls and spaces before acting on a
+    // URL, so `java\tscript:` and `\x01javascript:` execute as javascript:. Strip
+    // every [\x00-\x20] before detecting the scheme so the allowlist can't be
+    // evaded that way (R2-2).
+    const m = /^([a-z][a-z0-9+.-]*):/i.exec(url.replace(/[\x00-\x20]/g, ""));
+    return m ? m[1].toLowerCase() : null;
+}
+// A destination is safe to emit when it has no scheme (relative / anchor /
+// cross-doc), or names an allowlisted scheme. `data:` is permitted only for
+// media and only for `image/*` payloads (never `data:text/html`, which scripts).
+function isSafeUrl(url, allowDataImage = false) {
+    const scheme = schemeOf(url);
+    if (scheme === null)
+        return true;
+    if (SAFE_SCHEMES.has(scheme))
+        return true;
+    if (allowDataImage && scheme === "data")
+        return /^\s*data:image\//i.test(url);
+    return false;
+}
 // §5.1: when `as` is omitted, infer the media kind from the source extension.
 const VIDEO_EXT = /\.(mp4|webm|mov|m4v|ogv|mkv)(?:[?#].*)?$/i;
 const AUDIO_EXT = /\.(mp3|wav|ogg|oga|m4a|flac|aac|opus)(?:[?#].*)?$/i;
@@ -23,8 +57,12 @@ function inferAs(src) {
 // Classify a link/image destination into {href|doc, anchor}.
 function classifyDest(dest) {
     const d = dest.trim();
-    if (SCHEME.test(d))
-        return { href: d };
+    if (schemeOf(d) !== null) {
+        // Scheme-bearing destination: emit as an href only if the scheme is
+        // allowlisted; otherwise drop it entirely so the link renders inert
+        // (render() defaults a hrefless link to `#`, keeping the visible text).
+        return isSafeUrl(d) ? { href: d } : {};
+    }
     const hash = d.indexOf("#");
     if (hash === 0)
         return { anchor: d.slice(1) };
@@ -82,7 +120,7 @@ function readAttrs(s, i) {
 // Phase A: pull out high-priority atoms (escapes, code, math, media, links,
 // auto-refs, footnotes, hard breaks). Everything else is left as text runs for
 // phase B (emphasis). Children of links are fully re-parsed.
-function scanAtoms(s, line, sink) {
+function scanAtoms(s, line, sink, depth = 0) {
     const out = [];
     let buf = "";
     const flush = () => { if (buf) {
@@ -150,8 +188,14 @@ function scanAtoms(s, line, sink) {
             if (label && paren) {
                 const a = readAttrs(s, paren.end);
                 const attrObj = a ? a.attrs : { classes: [], attrs: {} };
+                // Media src bypasses classifyDest, so guard the scheme here: a disallowed
+                // scheme (javascript:, data:text/html, …) is neutralized to an empty src
+                // so the HTML sink cannot load/execute it. Relative paths, http(s), and
+                // image/* data URIs pass through.
+                const rawSrc = paren.content.trim();
+                const src = isSafeUrl(rawSrc, true) ? rawSrc : "";
                 const node = {
-                    type: "image", alt: label.content, src: paren.content.trim(), attrs: attrObj.attrs,
+                    type: "image", alt: label.content, src, attrs: attrObj.attrs,
                 };
                 const as = attrObj.attrs["as"];
                 if (typeof as === "string")
@@ -207,7 +251,7 @@ function scanAtoms(s, line, sink) {
                 const dest = classifyDest(paren.content);
                 const node = {
                     type: "link",
-                    children: parseInline(label.content, line, sink),
+                    children: parseInline(label.content, line, sink, depth + 1),
                     attrs: attrObj.attrs,
                 };
                 if (dest.href)
@@ -405,8 +449,17 @@ function mergeText(ns) {
     }
     return out;
 }
-export function parseInline(s, line, sink) {
-    const atoms = scanAtoms(s, line, sink);
+export function parseInline(s, line, sink, depth = 0) {
+    if (depth > MAX_INLINE_NESTING) {
+        // Pathological nesting (thousands of nested link labels) would overflow the
+        // call stack (R2-7). Degrade the over-deep content to text — emphasis only,
+        // no further link recursion — and flag it; never throw RangeError.
+        const diags = sink.diags;
+        if (Array.isArray(diags) && !diags.some((d) => d.message.startsWith("inline nesting too deep")))
+            diags.push({ severity: "error", message: `inline nesting too deep (max ${MAX_INLINE_NESTING})`, line });
+        return mergeText(emphasize(s));
+    }
+    const atoms = scanAtoms(s, line, sink, depth);
     const out = [];
     for (const a of atoms) {
         if (typeof a === "string")

package/dist/render-html.d.ts

@@ -0,0 +1,3 @@
+import { type Document } from "./geml.js";
+import { type RenderOptions } from "./render.js";
+export declare function renderHtml(doc: Document, opts?: RenderOptions): string;

package/dist/render-html.js

@@ -0,0 +1,95 @@
+// GEML CLI HTML export — the standalone, self-contained page.
+//
+// This is the CLI-only entry point that wraps a rendered document body in a
+// full HTML page shell. Math (KaTeX) and Mermaid load from a CDN, and only when
+// the document actually uses them, so a document of prose, tables and charts is
+// fully self-contained with zero network.
+//
+// It lives in its OWN module (separate from ./render) so that consumers who only
+// need the in-browser graph runtime (buildCodeGraph/codeGraphRuntime/
+// codeGraphWaves) — notably the browser-extension viewer bundle — never pull in
+// these CDN/remote-script string literals. The Chrome Web Store scanner rejects
+// bundles that contain remotely-hosted-code references.
+import { CSS, JS, CODE_GRAPH_JS, RenderCtx, esc, escAttr, } from "./render.js";
+function page(title, body, ctx, source) {
+    const mathHead = ctx.usedMath
+        ? `<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.11/dist/katex.min.css">\n` +
+            `<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.11/dist/katex.min.js"></script>\n` +
+            `<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.11/dist/contrib/auto-render.min.js" onload="renderMathInElement(document.body,{delimiters:[{left:'\\\\[',right:'\\\\]',display:true},{left:'\\\\(',right:'\\\\)',display:false}]})"></script>\n`
+        : "";
+    const mermaidHead = ctx.usedMermaid
+        ? `<script type="module">import m from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs";m.initialize({startOnLoad:true});</script>\n`
+        : "";
+    const footer = source
+        ? `<footer class="geml-footer">Rendered from <code>${esc(source)}</code> by the GEML runtime. Tables are sortable and filterable; the chart is inline SVG drawn from its bound table.</footer>`
+        : "";
+    // Live enhancement for served pages: attach _cgView loaders after the
+    // static bootstrap has drawn. The runtime reads the hook lazily, so late
+    // binding works with no redraw; if this module never loads (offline copy,
+    // old browser), the page simply stays static. The parser dist imports
+    // node:* for its CLI paths — an import map points those at the served stub
+    // (same trick as the viewer's esbuild alias), and the process shim must be
+    // in place BEFORE the modules evaluate, hence the dynamic import().
+    const wantLive = ctx.usedCodeGraph && !!ctx.opts.liveGraph;
+    const lg = wantLive ? escAttr(ctx.opts.liveGraph) : "";
+    const importMap = wantLive
+        ? `<script type="importmap">{"imports":{"node:fs":"${lg}_node-stub.js","node:path":"${lg}_node-stub.js","node:crypto":"${lg}_node-stub.js","node:url":"${lg}_node-stub.js","node:child_process":"${lg}_node-stub.js"}}</script>\n`
+        : "";
+    const liveJs = wantLive
+        ? `<script type="module">
+globalThis.process ??= { argv: [], env: {} };
+const { parse } = await import("${lg}geml.js");
+const { codeGraphWaves } = await import("${lg}render.js");
+const w = codeGraphWaves(async (rel) => {
+  try { const r = await fetch(rel, { cache: "no-cache" }); return r.ok ? await r.text() : null; } catch { return null; }
+}, parse);
+for (const m of document.querySelectorAll(".cg-mount[data-start]")) {
+  const start = m.getAttribute("data-start");
+  m._cgView = async (view) => {
+    // A directed view builds from the node's OWN document (its meta names the
+    // module and graph-depth); {doc} opens that document; else the mount's.
+    const src = view && view.doc ? view.doc
+      : view && view.node ? view.node.slice(0, view.node.lastIndexOf("#"))
+      : start;
+    const r = await w.build(src, view && view.doc ? undefined : view);
+    return r.error !== undefined ? null : r.data;
+  };
+}
+</script>\n`
+        : "";
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc(title)}</title>
+<style>${CSS}</style>
+${importMap}${mathHead}${mermaidHead}</head>
+<body>
+<main>
+${body}
+</main>
+${footer}
+<script>${JS}</script>
+${ctx.usedCodeGraph ? `<script>${CODE_GRAPH_JS}</script>\n` : ""}${liveJs}</body>
+</html>
+`;
+}
+export function renderHtml(doc, opts = {}) {
+    const ctx = new RenderCtx(doc, opts);
+    let body = doc.children.map((b) => ctx.block(b)).filter((s) => s !== "").join("\n");
+    // Codemap scenario ① (GEP-0003): a codemap document (meta declares module=
+    // or container=, plus an entry surface) IS the graph data — offer the layered
+    // method-flow view at the top, an implicit self-embed.
+    const meta = doc.children.find((b) => b.kind === "block" && b.type === "meta" && b.data);
+    const md = meta?.data ?? {};
+    if ((md["module"] !== undefined || md["container"] !== undefined)
+        && opts.loadDoc && opts.parseDoc && opts.source) {
+        const cap = md["entry"] !== undefined || md["container"] !== undefined
+            ? `layered method flow — roots from this document's <code>entry</code>`
+            : `layered method flow — roots: in-degree-zero methods (no <code>entry</code> declared)`;
+        body = ctx.codeGraphFigure(opts.source, "", `<figcaption>${cap}</figcaption>`) + "\n" + body;
+    }
+    const title = opts.title ?? ctx.docTitle() ?? "GEML document";
+    return page(title, body, ctx, opts.source);
+}