@geml/geml 1.6.0 → 1.7.1

package/codemap/browser-stub.mjs

@@ -12,6 +12,9 @@ export const writeFileSync = () => {};
 export const existsSync = () => false;
 export const realpathSync = (p) => p;
 export const statSync = () => ({ isDirectory: () => false });
+export const mkdirSync = () => {};
+export const readdirSync = () => [];
+export const copyFileSync = () => {};
 export const basename = (p) => p;
 export const dirname = (p) => p;
 export const resolve = (...p) => p.join("/");
@@ -21,6 +24,8 @@ export const relative = (_from, to) => to;
 export const sep = "/";
 export const fileURLToPath = (u) => String(u);
 export const spawnSync = () => ({ status: 1 });
+// node:os — `geml skill install` resolves the home directory; CLI-only.
+export const homedir = () => "/";
 export const createHash = () => ({
   update() { return this; },
   digest() { return ""; },

package/codemap/build.mjs

@@ -36,7 +36,7 @@
 //
 // After building, run:  geml codemap verify <out-dir>
 import { writeFileSync, mkdirSync, existsSync, readFileSync, statSync } from "node:fs";
-import { join, resolve, basename, dirname, relative } from "node:path";
+import { join, resolve, basename, dirname, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { execFileSync, spawnSync } from "node:child_process";
 import { emit } from "./emit.mjs";
@@ -100,7 +100,7 @@ if (root && !inputs.length) {
   const { files, manifests, pkgs } = collectSourceFiles(rootAbs);
   const excluder = makeExcluder({
     root: rootAbs, globs: excludeGlobs0, gitignore: !args.includes("--no-gitignore"),
-    files: [...files, ...manifests, ...pkgs], exec: execFileSync,
+    files: [...files, ...manifests, ...pkgs], run: execFileSync,
   });
   const jobs = detectLanguages(rootAbs, { files, manifests, pkgs, excluder });
   detectedLanguages = [...new Set(jobs.map((j) => j.language))];
@@ -136,7 +136,10 @@ if (root && !inputs.length) {
   // PATH (npx / joern) whose .cmd/.bat shim uses %~dp0 breaks if the name is
   // quoted — cmd then resolves %~dp0 against the cwd, not the shim's dir. A
   // spaced launcher PATH is a full path, so quoting it keeps %~dp0 correct.
-  const q = (s) => (/[\s"]/.test(String(s)) ? `"${String(s).replace(/"/g, '\\"')}"` : String(s));
+  // WHEN it does quote, it defers to shq below: escaping only `"` left a
+  // trailing backslash (a path ending `...\`) escaping our own closing quote,
+  // which merges the next token into this one. Same CRT rules, one source.
+  const q = (s) => (/[\s"]/.test(String(s)) ? shq(s) : String(s));
   // Hardened quote for command ARGUMENTS on win32. Node does NOT escape args
   // under shell:true — it only concatenates them (Node DEP0190) — so an
   // unquoted argument such as a source directory named `a&calc` reaching the
@@ -378,7 +381,7 @@ const excluder = makeExcluder({
   globs: excludeGlobs,
   gitignore: !args.includes("--no-gitignore"),
   files: [...new Set(symbols.map((s) => s.file))],
-  exec: execFileSync,
+  run: execFileSync,
 });
 const kept = symbols.filter((s) => !excluder(s.file));
 const excludedCount = symbols.length - kept.length;
@@ -391,7 +394,7 @@ if (root && !recordRecipe && !entryHints.length) {
   const c = collectSourceFiles(rootAbs);
   const excl = makeExcluder({
     root: rootAbs, globs: excludeGlobs, gitignore: !args.includes("--no-gitignore"),
-    files: [...c.files, ...c.manifests, ...c.pkgs], exec: execFileSync,
+    files: [...c.files, ...c.manifests, ...c.pkgs], run: execFileSync,
   });
   entryHints = detectEntries(rootAbs, {
     files: c.files.filter((f) => !excl(f)),
@@ -420,7 +423,18 @@ try {
   const { edges: httpEdges, audit } = buildCrossStackOverlay({
     symbols,
     files: scanFiles,
-    readText: (rel) => { try { return readFileSync(join(rootAbs, ...rel.split("/")), "utf8"); } catch { return null; } },
+    // `rel` is indexer OUTPUT, not a path this build authored, so a `..`
+    // segment must not turn a source read into an escape from the scanned
+    // root. Same gate the document resolver uses: resolve first, then require
+    // the result to BE the root or sit under it — compared with the separator,
+    // so a sibling named `<root>-evil` is not mistaken for a child.
+    readText: (rel) => {
+      try {
+        const p = resolve(rootAbs, ...String(rel).split("/"));
+        if (p !== rootAbs && !p.startsWith(rootAbs + sep)) return null;
+        return readFileSync(p, "utf8");
+      } catch { return null; }
+    },
   });
   for (const e of httpEdges) edges.push(e);
   if (httpEdges.length) {

package/codemap/exclude.mjs

@@ -15,17 +15,17 @@ import { execFileSync as _execFileSync } from "node:child_process";
 // Minimal gitignore-flavoured glob: `**` spans path separators, `*` stays
 // within a segment, everything else is literal. Anchored to the whole path.
 export function globToRegExp(glob) {
+  // The glob comes from a `--exclude` argument, so nothing in it may reach the
+  // compiled pattern as *syntax*. Split on the wildcards, keeping them (the
+  // capture group), which leaves the array strictly alternating: even indices
+  // are literal text, odd indices are `*`, `**` or `**/`. Literals go through a
+  // total regex-metacharacter escape; wildcards map to fixed patterns. Neither
+  // path can carry an unescaped metacharacter through.
+  const parts = String(glob).split(/(\*\*\/?|\*)/);
   let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") { re += ".*"; i++; if (glob[i + 1] === "/") i++; }
-      else re += "[^/]*";
-    } else if ("\\^$+?.()|{}[]".includes(c)) {
-      re += "\\" + c;
-    } else {
-      re += c;
-    }
+  for (let i = 0; i < parts.length; i++) {
+    if (i % 2 === 0) re += parts[i].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    else re += parts[i] === "*" ? "[^/]*" : ".*"; // `**` and `**/` span separators
   }
   return new RegExp("^" + re + "$");
 }
@@ -33,10 +33,14 @@ export function globToRegExp(glob) {
 // Ask git which of `files` it ignores. Returns a Set of the ignored paths.
 // check-ignore exits 1 when nothing matches and 128 when git is unavailable /
 // the dir is not a repo — both mean "ignore nothing", not a build failure.
-export function gitIgnored(root, files, exec = _execFileSync) {
+// The injected runner is named `run`, not `exec`: it is always an execFile-shaped
+// (program, args[]) call that spawns NO shell, whereas a callback named `exec`
+// reads — to a human skimming, and to a static analyser — as the shell-string
+// child_process API. The name should not imply the dangerous one.
+export function gitIgnored(root, files, run = _execFileSync) {
   if (!files.length) return new Set();
   try {
-    const out = exec("git", ["-C", root, "check-ignore", "--stdin"], { input: files.join("\n"), encoding: "utf8" });
+    const out = run("git", ["-C", root, "check-ignore", "--stdin"], { input: files.join("\n"), encoding: "utf8" });
     return new Set(out.split(/\r?\n/).filter(Boolean));
   } catch (e) {
     const out = e && e.stdout ? String(e.stdout) : "";
@@ -45,8 +49,8 @@ export function gitIgnored(root, files, exec = _execFileSync) {
 }
 
 // Build a predicate (file) => shouldExclude.
-export function makeExcluder({ root, globs = [], gitignore = true, files = [], exec } = {}) {
+export function makeExcluder({ root, globs = [], gitignore = true, files = [], run } = {}) {
   const res = globs.map(globToRegExp);
-  const ignored = gitignore ? gitIgnored(root, files, exec) : new Set();
+  const ignored = gitignore ? gitIgnored(root, files, run) : new Set();
   return (file) => ignored.has(file) || res.some((r) => r.test(file));
 }

package/codemap/refresh.mjs

@@ -95,7 +95,10 @@ let trusted = isRecipeTrusted(fingerprint);
 //     full path is quoted), every argument via shq (ALWAYS double-quoted, so
 //     cmd.exe treats & | < > ( ) ^ and whitespace as literal). An injected
 //     metachar inside a dir-name argument is therefore inert.
-const q = (s) => (/[\s"]/.test(String(s)) ? `"${String(s).replace(/"/g, '\\"')}"` : String(s));
+// q quotes only when it must; WHEN it does it defers to shq, so a program path
+// ending in a backslash cannot escape our own closing quote and swallow the
+// next token. One set of CRT rules, in one place.
+const q = (s) => (/[\s"]/.test(String(s)) ? shq(s) : String(s));
 const shq = (s) => `"${String(s).replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1')}"`;
 // Human-readable render of a step for the log / refusal message — DISPLAY ONLY,
 // never executed. Falls back to String() for a stale (non-structured) step.

package/codemap/verify.mjs

@@ -37,18 +37,28 @@ if (!cli) cli = existsSync(localParser) ? localParser : "geml";
 // `.geml` filename containing & | ( ) would otherwise break out and inject.
 // cmd.exe treats those metacharacters and whitespace as literal inside quotes;
 // CRT rules for embedded " / trailing \.
-const q = (s) => (/[\s"]/.test(String(s)) ? `"${String(s).replace(/"/g, '\\"')}"` : String(s));
+// q quotes only when it must; WHEN it does it defers to shq, so a program path
+// ending in a backslash cannot escape our own closing quote and swallow the
+// next token. One set of CRT rules, in one place.
+const q = (s) => (/[\s"]/.test(String(s)) ? shq(s) : String(s));
 const shq = (s) => `"${String(s).replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1')}"`;
+// A codemap document's `src=` routes are written relative to the indexed
+// SOURCE root (`geml-parser/src/attrs.ts` from a document two levels down), so
+// checking one has to be told that root — the same value `serve` derives, from
+// the recorded recipe, falling back to the parent of the graph directory.
+let srcRoot = resolve(rootDir, "..");
+try { srcRoot = resolve(rootDir, JSON.parse(readFileSync(join(rootDir, "_index", "refresh.json"), "utf8")).root ?? ".."); } catch { /* no recipe: parent */ }
+const checkArgs = (file) => ["check", "--root", srcRoot, file];
 const runCheck = (file) => {
   // The built-parser path: run node on geml.js directly (array args, no shell).
-  if (cli.endsWith(".js")) return spawnSync(process.execPath, [cli, "check", file], { encoding: "utf8" });
+  if (cli.endsWith(".js")) return spawnSync(process.execPath, [cli, ...checkArgs(file)], { encoding: "utf8" });
   // A non-.js cli may be a .cmd/.bat launcher (e.g. geml.cmd on PATH), which
   // Node can only spawn through the shell. Hand cmd.exe ONE pre-escaped command
   // string (never an args array — that is the unescaped, injection-prone path).
   if (process.platform === "win32") {
-    return spawnSync([q(cli), ...["check", file].map(shq)].join(" "), { encoding: "utf8", shell: true });
+    return spawnSync([q(cli), ...checkArgs(file).map(shq)].join(" "), { encoding: "utf8", shell: true });
   }
-  return spawnSync(cli, ["check", file], { encoding: "utf8" });
+  return spawnSync(cli, checkArgs(file), { encoding: "utf8" });
 };
 if (!existsSync(localParser)) {
   console.error("verify: the profile pass needs the built parser (cd geml-parser && npm install && npm run build)");

package/dist/chart.d.ts

@@ -3,6 +3,7 @@ import { type Value } from "./attrs.js";
 import { type TableModel } from "./table.js";
 export type ChartType = "bar" | "line" | "area" | "pie" | "scatter";
 export type RowScope = "data" | "all" | "summary";
+export declare const USES: Record<ChartType, Set<string>>;
 export interface ChartDataset {
     categories: string[];
     numbers: Record<string, number[]>;

package/dist/chart.js

@@ -8,7 +8,10 @@
 // doc and §7.
 const TYPES = new Set(["bar", "line", "area", "pie", "scatter"]);
 // Channels each type can use; supplying any other is a warning (ignored).
-const USES = {
+// Exported for the record-array projection (GEP-0005): it must validate only
+// the channels the chart TYPE actually reads, matching buildChart's leniency
+// (an unused channel is a warning here, so it must not be an error there).
+export const USES = {
     bar: new Set(["x", "y", "series"]),
     line: new Set(["x", "y", "series"]),
     area: new Set(["x", "y", "series"]),

package/dist/diagnostics.d.ts

@@ -1,4 +1,4 @@
-export type DiagnosticCode = "unterminated-block" | "unknown-block-type" | "unknown-attribute" | "block-nesting-too-deep" | "list-nesting-too-deep" | "inline-nesting-too-deep" | "duplicate-id" | "unresolved-reference" | "unresolved-footnote" | "unresolved-cross-document-reference" | "unresolvable-document" | "unchecked-cross-document-reference" | "embed-missing-src" | "ignored-embed-body" | "transclusion-cycle" | "embed-target-not-geml" | "media-target-is-document" | "inline-transclusion-not-inline" | "unsafe-embed-scheme" | "unresolvable-table-source" | "table-source-not-a-table" | "unknown-metadata-reference" | "table-src-and-body" | "unknown-table-format" | "bad-compute-formula" | "unlexable-compute-formula" | "compute-error" | "compute-non-numeric-cell" | "compute-not-a-number" | "bad-summary-entry" | "summary-unknown-column" | "unlexable-summary-expression" | "summary-error" | "unknown-diagram-format" | "ignored-diagram-body" | "code-graph-missing-src" | "code-graph-unresolvable-document" | "chart-missing-data" | "chart-data-not-a-table" | "chart-missing-type" | "chart-unknown-type" | "chart-unknown-rows-scope" | "chart-missing-channel" | "chart-empty-channel" | "chart-unknown-column" | "chart-unused-channel" | "chart-missing-summary-row" | "chart-summary-row-unavailable" | "chart-non-numeric-value";
+export type DiagnosticCode = "unterminated-block" | "unknown-block-type" | "unknown-attribute" | "block-nesting-too-deep" | "list-nesting-too-deep" | "inline-nesting-too-deep" | "stray-labeled-fence" | "fence-like-line" | "unresolvable-code-source" | "bad-code-source" | "bad-source-range" | "stale-code-snapshot" | "duplicate-id" | "unresolved-reference" | "unresolved-footnote" | "unresolved-cross-document-reference" | "unresolvable-document" | "unchecked-cross-document-reference" | "embed-missing-src" | "ignored-embed-body" | "transclusion-cycle" | "embed-target-not-geml" | "media-target-is-document" | "inline-transclusion-not-inline" | "unsafe-embed-scheme" | "unresolvable-table-source" | "table-source-not-a-table" | "unknown-metadata-reference" | "table-src-and-body" | "unknown-table-format" | "bad-table-delimiter" | "ignored-table-delimiter" | "bad-compute-formula" | "unlexable-compute-formula" | "compute-error" | "compute-non-numeric-cell" | "compute-not-a-number" | "bad-summary-entry" | "summary-unknown-column" | "unlexable-summary-expression" | "summary-error" | "unknown-diagram-format" | "ignored-diagram-body" | "code-graph-missing-src" | "code-graph-unresolvable-document" | "chart-missing-data" | "chart-data-not-a-table" | "chart-missing-type" | "chart-unknown-type" | "chart-unknown-rows-scope" | "chart-missing-channel" | "chart-empty-channel" | "chart-unknown-column" | "chart-unused-channel" | "chart-missing-summary-row" | "chart-summary-row-unavailable" | "chart-non-numeric-value" | "chart-data-not-records" | "data-parse" | "unknown-data-format" | "data-format-no-engine" | "bad-data-schema" | "data-src-and-body" | "bad-data-source" | "unresolvable-data-source";
 export interface Diagnostic {
     severity: "error" | "warning";
     code: DiagnosticCode;

package/dist/diagnostics.js

@@ -19,6 +19,12 @@ export const SEVERITY = {
     "block-nesting-too-deep": "error",
     "list-nesting-too-deep": "error",
     "inline-nesting-too-deep": "error",
+    "stray-labeled-fence": "warning",
+    "fence-like-line": "warning",
+    "unresolvable-code-source": "warning",
+    "bad-code-source": "error",
+    "bad-source-range": "error",
+    "stale-code-snapshot": "warning",
     "duplicate-id": "error",
     "unresolved-reference": "error",
     "unresolved-footnote": "error",
@@ -37,6 +43,8 @@ export const SEVERITY = {
     "unknown-metadata-reference": "error",
     "table-src-and-body": "error",
     "unknown-table-format": "warning",
+    "bad-table-delimiter": "error",
+    "ignored-table-delimiter": "warning",
     "bad-compute-formula": "error",
     "unlexable-compute-formula": "error",
     "compute-error": "error",
@@ -62,6 +70,14 @@ export const SEVERITY = {
     "chart-missing-summary-row": "error",
     "chart-summary-row-unavailable": "warning",
     "chart-non-numeric-value": "error",
+    "chart-data-not-records": "error",
+    "data-parse": "error",
+    "unknown-data-format": "warning",
+    "data-format-no-engine": "warning",
+    "bad-data-schema": "error",
+    "data-src-and-body": "error",
+    "bad-data-source": "error",
+    "unresolvable-data-source": "error",
 };
 // ---------------------------------------------------------------------------
 // Source normalization (spec §0)

package/dist/from-md.js

@@ -55,7 +55,12 @@ function metaLine(line) {
     if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))
         v = v.slice(1, -1);
     const bareSafe = /^[^\s"]+$/.test(v);
-    return bareSafe ? `${m[1]}=${v}` : `${m[1]}="${v.replace(/"/g, '\\"')}"`;
+    // No backslash escape here — a `data` block value is read by `coerce`, which
+    // simply strips the outer quotes (§4); GEML defines no `\"` escape at all.
+    // Emitting one wrote the backslash into the parsed value, so `a"b` came back
+    // as `a\"b`. Quoting the value verbatim round-trips instead: coerce keeps
+    // everything between the first and last quote, embedded quotes included.
+    return bareSafe ? `${m[1]}=${v}` : `${m[1]}="${v}"`;
 }
 // Rewrite Markdown autolinks `<https://…>` / `<mailto:…>` into GEML links
 // `[url](url)` (GEML has no autolink syntax). Inline code spans are left intact.

package/dist/geml.d.ts

@@ -8,11 +8,14 @@ export { type Value } from "./attrs.js";
 export { type Inline } from "./inline.js";
 export { type TableModel } from "./table.js";
 export { mdToGeml, type ConvertResult } from "./from-md.js";
-export { renderHtml } from "./render-html.js";
+export { renderHtml, pageAssets } from "./render-html.js";
 export { type RenderOptions } from "./render.js";
 export { serialize } from "./serialize.js";
 export { gemlToMd } from "./to-md.js";
 export type BodyMode = "raw" | "flow" | "data";
+export type DataValue = null | boolean | number | string | DataValue[] | {
+    [key: string]: DataValue;
+};
 export interface ListItem {
     text: string;
     inlines: Inline[];
@@ -53,6 +56,7 @@ export type Block = {
     data?: Record<string, Value>;
     table?: TableModel;
     chart?: ChartModel;
+    value?: DataValue;
     hidden?: boolean;
 };
 export { type Diagnostic, type DiagnosticCode, SEVERITY } from "./diagnostics.js";