@geml/geml 1.1.1 → 1.3.2

package/dist/history.js

@@ -205,16 +205,46 @@ function applyReverse(textLf, ops, blobs) {
             throw new Error(`history: unresolved blob:${id}`);
         return p.split("\n");
     };
+    // `delete`/`replace` name units in the INPUT document (v_new) — their `~n`
+    // occurrence suffixes are numbered over the whole of v_new. So resolve them
+    // against ONE snapshot of the unmutated input, not the live array: re-keying
+    // per op lets an earlier delete renumber a later op's occurrence (delete @h
+    // then delete @h~1 — after the first splice the survivor renumbers @h~1→@h
+    // and the second op can no longer find it). Keys are unique within a single
+    // keyedUnits() call, so the snapshot map is a bijection.
+    const snap = keyedUnits(lines);
+    const byKey = new Map(snap.map((k) => [k.key, k.u]));
+    const resolveSnap = (key) => {
+        const u = byKey.get(key);
+        if (!u)
+            throw new Error(`history: unit ${key} not found while applying reverse patch`);
+        return u;
+    };
+    const rangeEdits = [];
+    const anchored = []; // insert / move — resolved against the LIVE array below
     for (const op of ops) {
         if (op.kind === "delete") {
-            const u = locateUnit(lines, op.key);
-            lines.splice(u.start, u.endExcl - u.start);
+            const u = resolveSnap(op.key);
+            rangeEdits.push({ start: u.start, endExcl: u.endExcl, repl: [] });
         }
         else if (op.kind === "replace") {
-            const u = locateUnit(lines, op.key);
-            lines.splice(u.start, u.endExcl - u.start, ...blob(op.blob));
+            const u = resolveSnap(op.key);
+            rangeEdits.push({ start: u.start, endExcl: u.endExcl, repl: blob(op.blob) });
         }
-        else if (op.kind === "insert") {
+        else {
+            anchored.push(op);
+        }
+    }
+    rangeEdits.sort((a, b) => b.start - a.start);
+    for (const e of rangeEdits)
+        lines.splice(e.start, e.endExcl - e.start, ...e.repl);
+    // Inserts (and moves) run only after every delete/replace, so the array is
+    // already in its reconstructed (v_parent) shape: an insert's anchor names a
+    // v_parent unit, and chained inserts build on units added just before them —
+    // both need LIVE re-keying, which is correct here precisely because the
+    // occurrence keying is now stable (no more same-keyspace ops pending).
+    for (const op of anchored) {
+        if (op.kind === "insert") {
             insertAt(lines, op.anchor, blob(op.blob));
         }
         else { // move: cut the unit (with its owned blanks) and re-insert at anchor
@@ -228,68 +258,49 @@ function applyReverse(textLf, ops, blobs) {
 }
 /** LCS alignment of unit-key sequences; aMatch[i] = matched index in b, or -1.
  *
- * Fast path: content-keyed units (`@hash~n`) are unique by construction, and in
- * a well-formed document `#id` keys are unique too — and the LCS of two
- * all-unique sequences is exactly the longest increasing subsequence of a's
- * keys mapped to b's positions: O(n log n) instead of the O(n·m) DP table.
- * That difference is GEP-0002's measured bottleneck (seconds at 10⁴ units,
- * minutes at 10⁵ — code-graph documents live there).
+ * keyedUnits() assigns keys that are unique WITHIN each sequence (the `~n`
+ * occurrence suffix disambiguates equal content / repeated ids), so both `a`
+ * and `b` are all-unique. The LCS of two all-unique sequences is exactly the
+ * longest increasing subsequence of a's keys mapped to b's positions:
+ * O(n log n) instead of an O(n·m) DP table — GEP-0002's measured bottleneck
+ * (seconds at 10⁴ units, minutes at 10⁵; code-graph documents live there).
  *
- * A document with DUPLICATE `#id`s (a GEML error, but history never parses) can
- * break uniqueness, so the DP remains as the fallback for that case. Either
- * path yields *a* maximal alignment; commit()'s byte-exact round-trip gate
- * rejects any diff that fails to reproduce the parent, whichever path ran. */
+ * If keys were ever non-unique (no public entry point produces that — the only
+ * caller, diffReverse, feeds keyedUnits output), posInB keeps b's LAST index
+ * per key and the LIS still yields *a* valid monotonic matching; commit()'s
+ * byte-exact round-trip gate rejects any diff that fails to reproduce the
+ * parent regardless. */
 function lcsMatch(a, b) {
     const n = a.length, m = b.length;
     const aMatch = new Array(n).fill(-1);
-    if (new Set(a).size === n && new Set(b).size === m) {
-        const posInB = new Map();
-        for (let j = 0; j < m; j++)
-            posInB.set(b[j], j);
-        const ai = [], bj = []; // a-index / b-position of common keys, in a-order
-        for (let i = 0; i < n; i++) {
-            const j = posInB.get(a[i]);
-            if (j !== undefined) {
-                ai.push(i);
-                bj.push(j);
-            }
-        }
-        // Patience LIS over bj (strictly increasing) with predecessor links.
-        const tails = []; // index into bj of the smallest tail per LIS length
-        const prev = new Array(bj.length).fill(-1);
-        for (let x = 0; x < bj.length; x++) {
-            let lo = 0, hi = tails.length;
-            while (lo < hi) {
-                const mid = (lo + hi) >> 1;
-                if (bj[tails[mid]] < bj[x])
-                    lo = mid + 1;
-                else
-                    hi = mid;
-            }
-            prev[x] = lo > 0 ? tails[lo - 1] : -1;
-            tails[lo] = x;
-        }
-        for (let cur = tails.length ? tails[tails.length - 1] : -1; cur >= 0; cur = prev[cur]) {
-            aMatch[ai[cur]] = bj[cur];
+    const posInB = new Map();
+    for (let j = 0; j < m; j++)
+        posInB.set(b[j], j);
+    const ai = [], bj = []; // a-index / b-position of common keys, in a-order
+    for (let i = 0; i < n; i++) {
+        const j = posInB.get(a[i]);
+        if (j !== undefined) {
+            ai.push(i);
+            bj.push(j);
         }
-        return aMatch;
     }
-    // Fallback (duplicate keys): classic DP.
-    const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
-    for (let i = n - 1; i >= 0; i--)
-        for (let j = m - 1; j >= 0; j--)
-            dp[i][j] = a[i] === b[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
-    let i = 0, j = 0;
-    while (i < n && j < m) {
-        if (a[i] === b[j]) {
-            aMatch[i] = j;
-            i++;
-            j++;
-        }
-        else if (dp[i + 1][j] >= dp[i][j + 1])
-            i++;
-        else
-            j++;
+    // Patience LIS over bj (strictly increasing) with predecessor links.
+    const tails = []; // index into bj of the smallest tail per LIS length
+    const prev = new Array(bj.length).fill(-1);
+    for (let x = 0; x < bj.length; x++) {
+        let lo = 0, hi = tails.length;
+        while (lo < hi) {
+            const mid = (lo + hi) >> 1;
+            if (bj[tails[mid]] < bj[x])
+                lo = mid + 1;
+            else
+                hi = mid;
+        }
+        prev[x] = lo > 0 ? tails[lo - 1] : -1;
+        tails[lo] = x;
+    }
+    for (let cur = tails.length ? tails[tails.length - 1] : -1; cur >= 0; cur = prev[cur]) {
+        aMatch[ai[cur]] = bj[cur];
     }
     return aMatch;
 }
@@ -529,17 +540,46 @@ export function verify(historyPath, gemlPath) {
     catch (e) {
         errors.push(String(e.message));
     }
+    // Reconstruct every revision INCREMENTALLY. `reconstruct(h, id)` on its own
+    // rebuilds each revision from the nearest keyframe, replaying up to O(N) ops
+    // each time; calling it once per revision is therefore O(N²·K) and lets a
+    // ~91 KB sidecar take ~a minute. Because the chain runs newest->oldest and
+    // (for revisions without their own keyframe) nearest-keyframe(i) is always
+    // nearest-keyframe(i-1), reconstruct(chain[i]) == applyReverse(reconstruct(
+    // chain[i-1]), chain[i-1].ops). So we carry the previous revision's content
+    // forward and apply ONE reverse patch per step — O(N·K) overall — while
+    // validating the exact same reconstructed bytes for every revision. Whenever
+    // that carried base is not trustworthy (a keyframe-less head, or right after
+    // a step threw) we fall back to the full `reconstruct`, which reproduces the
+    // original's behaviour and error messages verbatim.
+    let prevContent = null;
+    let prevOps = null;
+    let baseValid = false;
     for (const r of chain) {
         try {
-            const content = reconstruct(h, r.id);
+            let content;
+            if (h.keyframes.has(r.id)) {
+                content = h.keyframes.get(r.id);
+            }
+            else if (baseValid && prevContent !== null && prevOps !== null) {
+                content = applyReverse(prevContent, prevOps, h.blobs);
+            }
+            else {
+                content = reconstruct(h, r.id);
+            }
             if (!hashMatchesRecorded(content, r, h.nl)) {
                 errors.push(`revision ${r.id}: reconstructed hash ${fullHash(content, nlOf(r.newline) ?? h.nl)} != recorded ${r.hash}`);
             }
+            prevContent = content;
+            baseValid = true;
             checked++;
         }
         catch (e) {
             errors.push(`revision ${r.id}: ${e.message}`);
+            prevContent = null;
+            baseValid = false; // a failed step is not a valid base for the next
         }
+        prevOps = r.ops;
     }
     if (gemlPath && existsSync(gemlPath)) {
         const { lf, nl } = loadBytes(gemlPath);

package/dist/inline.d.ts

@@ -49,4 +49,5 @@ export interface Ref {
 export interface RefSink {
     refs: Ref[];
 }
-export declare function parseInline(s: string, line: number, sink: RefSink): Inline[];
+export declare const META_REF_SRC = "\\{\\{\\s*([A-Za-z_][A-Za-z0-9_-]*)\\s*\\}\\}";
+export declare function parseInline(s: string, line: number, sink: RefSink, depth?: number): Inline[];

package/dist/inline.js

@@ -6,7 +6,41 @@
 // internal/cross-document reference is reported to a `RefSink` so the document
 // layer can resolve and validate it at build time (§8).
 import { parseAttrs } from "./attrs.js";
-const SCHEME = /^[a-z][a-z0-9+.-]*:/i; // http:, https:, mailto:, …
+const MAX_INLINE_NESTING = 100; // cap parseInline<->scanAtoms recursion (R2-7 DoS)
+// §4: the source pattern of a `{{key}}` metadata reference. Owned here as the
+// single definition of what a reference looks like — the parser substitutes it
+// (geml.ts), the serializer escapes it on emit (serialize.ts), and the md
+// converter escapes it on conversion (from-md.ts). Build flagged variants with
+// `new RegExp(META_REF_SRC, flags)`.
+export const META_REF_SRC = "\\{\\{\\s*([A-Za-z_][A-Za-z0-9_-]*)\\s*\\}\\}";
+// §5: URL schemes that may be emitted as an href/src. A destination that names
+// any other scheme (javascript:, vbscript:, data:text/html, file:, …) is a
+// script-injection / local-read vector at the HTML sink, so it is neutralized
+// here at the parse layer — every consumer of the model inherits the guard.
+const SAFE_SCHEMES = new Set(["http", "https", "mailto", "tel"]);
+// The leading `scheme:` (RFC-3986 grammar), lowercased — or null when the
+// destination has none (a relative path, `#anchor`, or cross-document ref).
+function schemeOf(url) {
+    // Browsers strip leading/embedded C0 controls and spaces before acting on a
+    // URL, so `java\tscript:` and `\x01javascript:` execute as javascript:. Strip
+    // every [\x00-\x20] before detecting the scheme so the allowlist can't be
+    // evaded that way (R2-2).
+    const m = /^([a-z][a-z0-9+.-]*):/i.exec(url.replace(/[\x00-\x20]/g, ""));
+    return m ? m[1].toLowerCase() : null;
+}
+// A destination is safe to emit when it has no scheme (relative / anchor /
+// cross-doc), or names an allowlisted scheme. `data:` is permitted only for
+// media and only for `image/*` payloads (never `data:text/html`, which scripts).
+function isSafeUrl(url, allowDataImage = false) {
+    const scheme = schemeOf(url);
+    if (scheme === null)
+        return true;
+    if (SAFE_SCHEMES.has(scheme))
+        return true;
+    if (allowDataImage && scheme === "data")
+        return /^\s*data:image\//i.test(url);
+    return false;
+}
 // §5.1: when `as` is omitted, infer the media kind from the source extension.
 const VIDEO_EXT = /\.(mp4|webm|mov|m4v|ogv|mkv)(?:[?#].*)?$/i;
 const AUDIO_EXT = /\.(mp3|wav|ogg|oga|m4a|flac|aac|opus)(?:[?#].*)?$/i;
@@ -23,8 +57,12 @@ function inferAs(src) {
 // Classify a link/image destination into {href|doc, anchor}.
 function classifyDest(dest) {
     const d = dest.trim();
-    if (SCHEME.test(d))
-        return { href: d };
+    if (schemeOf(d) !== null) {
+        // Scheme-bearing destination: emit as an href only if the scheme is
+        // allowlisted; otherwise drop it entirely so the link renders inert
+        // (render() defaults a hrefless link to `#`, keeping the visible text).
+        return isSafeUrl(d) ? { href: d } : {};
+    }
     const hash = d.indexOf("#");
     if (hash === 0)
         return { anchor: d.slice(1) };
@@ -82,7 +120,7 @@ function readAttrs(s, i) {
 // Phase A: pull out high-priority atoms (escapes, code, math, media, links,
 // auto-refs, footnotes, hard breaks). Everything else is left as text runs for
 // phase B (emphasis). Children of links are fully re-parsed.
-function scanAtoms(s, line, sink) {
+function scanAtoms(s, line, sink, depth = 0) {
     const out = [];
     let buf = "";
     const flush = () => { if (buf) {
@@ -150,8 +188,14 @@ function scanAtoms(s, line, sink) {
             if (label && paren) {
                 const a = readAttrs(s, paren.end);
                 const attrObj = a ? a.attrs : { classes: [], attrs: {} };
+                // Media src bypasses classifyDest, so guard the scheme here: a disallowed
+                // scheme (javascript:, data:text/html, …) is neutralized to an empty src
+                // so the HTML sink cannot load/execute it. Relative paths, http(s), and
+                // image/* data URIs pass through.
+                const rawSrc = paren.content.trim();
+                const src = isSafeUrl(rawSrc, true) ? rawSrc : "";
                 const node = {
-                    type: "image", alt: label.content, src: paren.content.trim(), attrs: attrObj.attrs,
+                    type: "image", alt: label.content, src, attrs: attrObj.attrs,
                 };
                 const as = attrObj.attrs["as"];
                 if (typeof as === "string")
@@ -207,7 +251,7 @@ function scanAtoms(s, line, sink) {
                 const dest = classifyDest(paren.content);
                 const node = {
                     type: "link",
-                    children: parseInline(label.content, line, sink),
+                    children: parseInline(label.content, line, sink, depth + 1),
                     attrs: attrObj.attrs,
                 };
                 if (dest.href)
@@ -405,8 +449,17 @@ function mergeText(ns) {
     }
     return out;
 }
-export function parseInline(s, line, sink) {
-    const atoms = scanAtoms(s, line, sink);
+export function parseInline(s, line, sink, depth = 0) {
+    if (depth > MAX_INLINE_NESTING) {
+        // Pathological nesting (thousands of nested link labels) would overflow the
+        // call stack (R2-7). Degrade the over-deep content to text — emphasis only,
+        // no further link recursion — and flag it; never throw RangeError.
+        const diags = sink.diags;
+        if (Array.isArray(diags) && !diags.some((d) => d.message.startsWith("inline nesting too deep")))
+            diags.push({ severity: "error", message: `inline nesting too deep (max ${MAX_INLINE_NESTING})`, line });
+        return mergeText(emphasize(s));
+    }
+    const atoms = scanAtoms(s, line, sink, depth);
     const out = [];
     for (const a of atoms) {
         if (typeof a === "string")

package/dist/render-html.d.ts

@@ -0,0 +1,3 @@
+import { type Document } from "./geml.js";
+import { type RenderOptions } from "./render.js";
+export declare function renderHtml(doc: Document, opts?: RenderOptions): string;

package/dist/render-html.js

@@ -0,0 +1,95 @@
+// GEML CLI HTML export — the standalone, self-contained page.
+//
+// This is the CLI-only entry point that wraps a rendered document body in a
+// full HTML page shell. Math (KaTeX) and Mermaid load from a CDN, and only when
+// the document actually uses them, so a document of prose, tables and charts is
+// fully self-contained with zero network.
+//
+// It lives in its OWN module (separate from ./render) so that consumers who only
+// need the in-browser graph runtime (buildCodeGraph/codeGraphRuntime/
+// codeGraphWaves) — notably the browser-extension viewer bundle — never pull in
+// these CDN/remote-script string literals. The Chrome Web Store scanner rejects
+// bundles that contain remotely-hosted-code references.
+import { CSS, JS, CODE_GRAPH_JS, RenderCtx, esc, escAttr, } from "./render.js";
+function page(title, body, ctx, source) {
+    const mathHead = ctx.usedMath
+        ? `<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.11/dist/katex.min.css">\n` +
+            `<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.11/dist/katex.min.js"></script>\n` +
+            `<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.11/dist/contrib/auto-render.min.js" onload="renderMathInElement(document.body,{delimiters:[{left:'\\\\[',right:'\\\\]',display:true},{left:'\\\\(',right:'\\\\)',display:false}]})"></script>\n`
+        : "";
+    const mermaidHead = ctx.usedMermaid
+        ? `<script type="module">import m from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs";m.initialize({startOnLoad:true});</script>\n`
+        : "";
+    const footer = source
+        ? `<footer class="geml-footer">Rendered from <code>${esc(source)}</code> by the GEML runtime. Tables are sortable and filterable; the chart is inline SVG drawn from its bound table.</footer>`
+        : "";
+    // Live enhancement for served pages: attach _cgView loaders after the
+    // static bootstrap has drawn. The runtime reads the hook lazily, so late
+    // binding works with no redraw; if this module never loads (offline copy,
+    // old browser), the page simply stays static. The parser dist imports
+    // node:* for its CLI paths — an import map points those at the served stub
+    // (same trick as the viewer's esbuild alias), and the process shim must be
+    // in place BEFORE the modules evaluate, hence the dynamic import().
+    const wantLive = ctx.usedCodeGraph && !!ctx.opts.liveGraph;
+    const lg = wantLive ? escAttr(ctx.opts.liveGraph) : "";
+    const importMap = wantLive
+        ? `<script type="importmap">{"imports":{"node:fs":"${lg}_node-stub.js","node:path":"${lg}_node-stub.js","node:crypto":"${lg}_node-stub.js","node:url":"${lg}_node-stub.js","node:child_process":"${lg}_node-stub.js"}}</script>\n`
+        : "";
+    const liveJs = wantLive
+        ? `<script type="module">
+globalThis.process ??= { argv: [], env: {} };
+const { parse } = await import("${lg}geml.js");
+const { codeGraphWaves } = await import("${lg}render.js");
+const w = codeGraphWaves(async (rel) => {
+  try { const r = await fetch(rel, { cache: "no-cache" }); return r.ok ? await r.text() : null; } catch { return null; }
+}, parse);
+for (const m of document.querySelectorAll(".cg-mount[data-start]")) {
+  const start = m.getAttribute("data-start");
+  m._cgView = async (view) => {
+    // A directed view builds from the node's OWN document (its meta names the
+    // module and graph-depth); {doc} opens that document; else the mount's.
+    const src = view && view.doc ? view.doc
+      : view && view.node ? view.node.slice(0, view.node.lastIndexOf("#"))
+      : start;
+    const r = await w.build(src, view && view.doc ? undefined : view);
+    return r.error !== undefined ? null : r.data;
+  };
+}
+</script>\n`
+        : "";
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc(title)}</title>
+<style>${CSS}</style>
+${importMap}${mathHead}${mermaidHead}</head>
+<body>
+<main>
+${body}
+</main>
+${footer}
+<script>${JS}</script>
+${ctx.usedCodeGraph ? `<script>${CODE_GRAPH_JS}</script>\n` : ""}${liveJs}</body>
+</html>
+`;
+}
+export function renderHtml(doc, opts = {}) {
+    const ctx = new RenderCtx(doc, opts);
+    let body = doc.children.map((b) => ctx.block(b)).filter((s) => s !== "").join("\n");
+    // Codemap scenario ① (GEP-0003): a codemap document (meta declares module=
+    // or container=, plus an entry surface) IS the graph data — offer the layered
+    // method-flow view at the top, an implicit self-embed.
+    const meta = doc.children.find((b) => b.kind === "block" && b.type === "meta" && b.data);
+    const md = meta?.data ?? {};
+    if ((md["module"] !== undefined || md["container"] !== undefined)
+        && opts.loadDoc && opts.parseDoc && opts.source) {
+        const cap = md["entry"] !== undefined || md["container"] !== undefined
+            ? `layered method flow — roots from this document's <code>entry</code>`
+            : `layered method flow — roots: in-degree-zero methods (no <code>entry</code> declared)`;
+        body = ctx.codeGraphFigure(opts.source, "", `<figcaption>${cap}</figcaption>`) + "\n" + body;
+    }
+    const title = opts.title ?? ctx.docTitle() ?? "GEML document";
+    return page(title, body, ctx, opts.source);
+}

package/dist/render.d.ts

@@ -1,4 +1,5 @@
-import { type Document } from "./geml.js";
+import { type Block, type Document } from "./geml.js";
+import { type Inline } from "./inline.js";
 export interface RenderOptions {
     title?: string;
     source?: string;
@@ -8,6 +9,32 @@ export interface RenderOptions {
     liveGraph?: string;
     graphSidecar?: string;
 }
+export declare function esc(s: string): string;
+export declare function escAttr(s: string): string;
+export declare class RenderCtx {
+    private doc;
+    readonly opts: RenderOptions;
+    usedMath: boolean;
+    usedMermaid: boolean;
+    usedCodeGraph: boolean;
+    private renderDepth;
+    labels: Map<string, string>;
+    constructor(doc: Document, opts?: RenderOptions);
+    get isCodemapDoc(): boolean;
+    private indexLabels;
+    docTitle(): string | undefined;
+    inlines(ns: Inline[]): string;
+    private inline;
+    private media;
+    private link;
+    block(b: Block): string;
+    private blockInner;
+    private list;
+    private typed;
+    private diagram;
+    codeGraphFigure(src: string, idAttr: string, cap: string): string;
+    private table;
+}
 interface CGNode {
     n: string;
     doc?: string;
@@ -16,6 +43,7 @@ interface CGNode {
     test?: boolean;
     acc?: boolean;
     more?: boolean;
+    entry?: boolean;
     grp?: string[];
     ext?: number;
 }
@@ -47,9 +75,12 @@ declare function buildCodeGraph(startRel: string, opts: RenderOptions, view?: {
     error?: string;
     truncated?: boolean;
 };
+export declare const CSS = "\n:root { --fg:#1f2328; --muted:#656d76; --bd:#d0d7de; --bg:#fff; --accent:#2563eb; --code-bg:#f6f8fa; }\n* { box-sizing: border-box; }\nbody { margin:0; color:var(--fg); background:#fafbfc; font:16px/1.6 -apple-system,BlinkMacSystemFont,\"Segoe UI\",Helvetica,Arial,\"PingFang SC\",\"Microsoft Yahei\",sans-serif; }\nmain { max-width: 860px; margin: 0 auto; padding: 48px 24px 96px; background:var(--bg); }\nh1,h2,h3,h4,h5,h6 { line-height:1.25; margin:1.6em 0 .6em; scroll-margin-top:16px; }\nh1 { font-size:2em; border-bottom:1px solid var(--bd); padding-bottom:.3em; }\nh2 { font-size:1.5em; border-bottom:1px solid var(--bd); padding-bottom:.3em; }\nh3 { font-size:1.25em; } h4 { font-size:1em; }\np { margin:.7em 0; }\na { color:var(--accent); text-decoration:none; } a:hover { text-decoration:underline; }\ncode { background:var(--code-bg); padding:.15em .35em; border-radius:6px; font:.88em ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; }\npre { background:var(--code-bg); padding:14px 16px; border-radius:8px; overflow:auto; }\npre code { background:none; padding:0; font-size:.85em; }\npre.output { background:#0d1117; color:#e6edf3; }\npre.output code { color:inherit; }\nul,ol { padding-left:1.6em; } li { margin:.2em 0; }\nul.task-list { list-style:none; padding-left:.2em; }\nli.task input[type=checkbox] { appearance:none; -webkit-appearance:none; width:1.1em; height:1.1em; margin:0 .5em 0 0; vertical-align:-.2em; border:1.5px solid #c8ccd0; border-radius:4px; background:#fff; position:relative; opacity:1; cursor:default; box-sizing:border-box; }\nli.task input[type=checkbox]:checked { background-color:#1f883d; border-color:#1f883d; }\nli.task input[type=checkbox]:checked::after { content:\"\u2713\"; position:absolute; top:0; right:0; bottom:0; left:0; display:flex; align-items:center; justify-content:center; color:#fff; font-size:.8em; line-height:1; font-weight:700; }\naside.callout { border-left:4px solid var(--accent); background:#f0f6ff; padding:.4em 16px; border-radius:0 8px 8px 0; margin:1em 0; }\naside.aside { border-left-color:#8b949e; background:#f6f8fa; }\naside.warning { border-left-color:#d97706; background:#fff8f0; }\naside.callout > :first-child { margin-top:0; } aside.callout > :last-child { margin-bottom:0; }\nfigure { margin:1.2em 0; }\nfigcaption { color:var(--muted); font-size:.86em; text-align:center; margin-top:.5em; }\ntable.geml-table { border-collapse:collapse; width:100%; font-size:.92em; }\ntable.geml-table th, table.geml-table td { border:1px solid var(--bd); padding:6px 12px; }\ntable.geml-table thead th { background:var(--code-bg); cursor:pointer; user-select:none; white-space:nowrap; }\ntable.geml-table thead th::after { content:\" \\2195\"; color:var(--muted); font-size:.8em; }\ntable.geml-table thead th.asc::after { content:\" \\2191\"; color:var(--accent); }\ntable.geml-table thead th.desc::after { content:\" \\2193\"; color:var(--accent); }\ntable.geml-table tbody tr:nth-child(2n) { background:#fafbfc; }\ntable.geml-table td.computed { color:#0a7c52; }\ntable.geml-table tfoot td { background:var(--code-bg); font-weight:600; border-top:2px solid var(--bd); }\n.table-tools { margin-bottom:6px; } .table-filter { width:240px; max-width:100%; padding:5px 9px; border:1px solid var(--bd); border-radius:7px; font-size:.85em; }\n.table-figure details > summary { cursor:pointer; color:var(--muted); font-size:.86em; padding:4px 0; }\n.table-note { color:var(--muted); font-size:.82em; margin:6px 0 0; }\n.geml-chart { width:100%; height:auto; background:var(--bg); border:1px solid var(--bd); border-radius:8px; }\n.c-title { font-size:15px; font-weight:600; fill:var(--fg); }\n.c-grid { stroke:#eaecef; } .c-axis { stroke:#aab1b8; } .c-tick { font-size:11px; fill:var(--muted); } .c-legend { font-size:12px; fill:var(--fg); }\n.media { max-width:100%; border-radius:8px; }\n.diagram-src { color:var(--muted); } .render-error { color:#cf222e; }\n.math-block { overflow-x:auto; padding:.4em 0; }\nsup.fn a { font-size:.75em; }\n.geml-footer { max-width:860px; margin:0 auto; padding:16px 24px 40px; color:var(--muted); font-size:.82em; }\n.geml-footer code { font-size:.95em; }\n.code-graph { margin:1.4em 0; }\n.cg-mount { border:1px solid var(--bd); border-radius:8px; padding:10px 12px; background:var(--bg); }\n.cg-scroll { overflow:auto; min-height:52vh; max-height:72vh; }\n.cg-svg { display:block; }\n.cg-search-wrap { position:relative; display:inline-block; }\n.cg-search { font:12px/1.4 inherit; padding:2px 7px; border:1px solid var(--bd); border-radius:4px; background:var(--bg); color:var(--fg); min-width:13ch; }\n.cg-search-menu { position:absolute; z-index:30; top:calc(100% + 2px); left:0; min-width:24ch; max-width:52ch; max-height:52vh; overflow:auto; background:var(--bg); border:1px solid var(--bd); border-radius:6px; box-shadow:0 6px 20px rgba(0,0,0,.18); }\n.cg-search-row { display:block; width:100%; text-align:left; padding:4px 9px 4px 18px; border:0; background:none; color:var(--fg); cursor:pointer; font:12px/1.4 inherit; }\n.cg-search-row:hover { background:var(--bd); }\n.cg-search-count { position:sticky; top:0; padding:4px 9px; font-size:11px; opacity:.65; background:var(--bg); border-bottom:1px solid var(--bd); }\n.cg-search-grp { padding:6px 9px 2px; font-size:11px; font-weight:600; opacity:.7; border-top:1px solid var(--bd); }\n.cg-search-grp:first-of-type { border-top:0; }\n.cg-stage { display:flex; gap:10px; align-items:flex-start; }\n.cg-stage .cg-scroll { flex:1 1 auto; min-width:0; }\n.cg-src { flex:0 0 42%; max-width:46%; display:flex; flex-direction:column; border:1px solid var(--bd); border-radius:6px; overflow:hidden; background:var(--bg); }\n.cg-src-hd { display:flex; gap:8px; align-items:center; justify-content:space-between; padding:4px 8px; border-bottom:1px solid var(--bd); color:var(--muted); font:.76em ui-monospace,Consolas,monospace; word-break:break-all; }\n.cg-src-hd button { font:inherit; border:1px solid var(--bd); border-radius:5px; background:transparent; color:var(--muted); cursor:pointer; padding:0 6px; }\n.cg-src-body { margin:0; padding:8px 10px; overflow:auto; max-height:72vh; color:var(--fg); font:12px/1.5 ui-monospace,Consolas,monospace; white-space:pre; }\n.cg-src-note { color:var(--muted); font-style:italic; white-space:pre-wrap; }\n.cg-bar { display:flex; gap:8px; align-items:center; flex-wrap:wrap; font-size:.82em; color:var(--muted); margin-bottom:6px; }\n.cg-bar button { font:inherit; padding:1px 8px; border:1px solid var(--bd); border-radius:5px; background:transparent; cursor:pointer; }\n.cg-crumb .cg-seg { border:0; border-radius:0; padding:0; background:none; color:var(--accent); cursor:pointer; font:inherit; }\n.cg-crumb .cg-seg:hover { text-decoration:underline; }\n.cg-frame { display:block; width:100%; height:72vh; border:0; background:var(--bg); }\n.cg-flash { color:#b42318; }\n.cg-legend { display:flex; gap:14px; align-items:center; justify-content:space-between; flex-wrap:wrap; font-size:.75em; color:var(--muted); margin-top:6px; }\n.cg-upbtn { cursor:pointer; }\n.cg-upbtn circle { fill:#fff; stroke:#94a3b8; }\n.cg-upbtn text { font-size:11px; fill:#57606a; }\n.cg-upbtn:hover circle { stroke:var(--accent); stroke-width:1.6; }\n.cg-upbtn:hover text { fill:var(--accent); }\n.cg-uplink { fill:none; stroke:#94a3b8; stroke-dasharray:3 2.5; pointer-events:none; }\n.cg-groups { display:flex; flex-wrap:wrap; gap:4px 12px; margin-top:6px; font-size:.75em; color:var(--muted); }\n.cg-chip { display:inline-flex; align-items:center; gap:4px; }\n.cg-chip i { width:10px; height:10px; border-radius:2px; border:1px solid #94a3b8; display:inline-block; }\n.cg-note { font-size:.8em; color:#9a6700; }\n.cg-n rect { fill:#eef2f7; stroke:#94a3b8; }\n.cg-n text { font-size:12px; fill:var(--fg); font-family:ui-monospace,Consolas,monospace; }\n.cg-n { cursor:pointer; }\n.cg-n.root rect { fill:#dbeafe; stroke:#2563eb; stroke-width:2; }\n.cg-n.leaf { opacity:.45; }\n.cg-n.test rect { stroke-dasharray:3 2; }\n.cg-n.grp rect { stroke-width:1.8; }\n.cg-e { fill:none; stroke:#94a3b8; stroke-width:.9; }\n.cg-e.cand { stroke-dasharray:2 3; }\n.cg-e.back { stroke:#dc2626; stroke-dasharray:5 3; }\n.cg-e.soft { opacity:.55; }\n.cg-svg.hl .cg-n { opacity:.22; }\n.cg-svg.hl .cg-e { opacity:.1; }\n.cg-svg.hl .cg-n.hl { opacity:1; }\n.cg-svg.hl .cg-e.hl { opacity:1; stroke-width:1.6; }\n";
+export declare const JS = "\n(function () {\n  function cmp(a, b) {\n    var na = a.dataset.sort, nb = b.dataset.sort;\n    if (na !== undefined && nb !== undefined) return parseFloat(na) - parseFloat(nb);\n    return (a.textContent || \"\").localeCompare(b.textContent || \"\");\n  }\n  document.querySelectorAll(\"table.geml-table\").forEach(function (table) {\n    var tbody = table.tBodies[0];\n    if (!tbody) return;\n    // Sort on header click.\n    var ths = table.tHead ? table.tHead.rows[0].cells : [];\n    Array.prototype.forEach.call(ths, function (th, col) {\n      th.addEventListener(\"click\", function () {\n        var dir = th.classList.contains(\"asc\") ? \"desc\" : \"asc\";\n        Array.prototype.forEach.call(ths, function (h) { h.classList.remove(\"asc\", \"desc\"); });\n        th.classList.add(dir);\n        var rows = Array.prototype.slice.call(tbody.rows);\n        rows.sort(function (r1, r2) {\n          var c = cmp(r1.cells[col], r2.cells[col]);\n          return dir === \"asc\" ? c : -c;\n        });\n        rows.forEach(function (r) { tbody.appendChild(r); });\n      });\n    });\n    // Filter rows.\n    var fig = table.closest(\".table-figure\");\n    var input = fig ? fig.querySelector(\".table-filter\") : null;\n    if (input) input.addEventListener(\"input\", function () {\n      var q = input.value.toLowerCase();\n      Array.prototype.forEach.call(tbody.rows, function (r) {\n        r.style.display = (r.textContent || \"\").toLowerCase().indexOf(q) >= 0 ? \"\" : \"none\";\n      });\n    });\n  });\n})();\n";
 export declare function codeGraphRuntime(root: {
     querySelectorAll(sel: string): ArrayLike<Element>;
 }): void;
+export declare const CODE_GRAPH_JS: string;
 export declare function codeGraphWaves(fetchDoc: (rel: string) => Promise<string | null>, parseFn: (s: string) => Document): {
     build: (src: string, view?: {
         dir?: "up" | "down";
@@ -62,4 +93,3 @@ export declare function codeGraphWaves(fetchDoc: (rel: string) => Promise<string
     seed: (name: string, text: string | null) => void;
 };
 export { buildCodeGraph };
-export declare function renderHtml(doc: Document, opts?: RenderOptions): string;