@odla-ai/blog 0.0.5 → 0.0.6

package/README.md

@@ -47,6 +47,15 @@ same-named file in your site's `theme/` directory. Build your site with the
 package API and preview the emitted static directory with your usual local
 static server.
 
+## Input boundaries
+
+Footnote identifiers are capped at 256 characters, and malformed `[^`
+introducers are handled by a monotonic scanner so adversarial Markdown cannot
+force repeated whole-suffix regex scans. Markdown still permits authored raw
+HTML by design; it is not a sanitizer. JS pages and collection templates must
+use `escapeHtml(String(value))` for every schema-free frontmatter value or
+filename-derived slug placed into HTML.
+
 ## Deploy (Cloudflare)
 
 `build()` emits a plain static directory; serve it from a Worker assets

package/llms.txt

@@ -87,7 +87,9 @@ package (`import { escapeHtml, renderMarkdown, postList } from "@odla-ai/blog"`)
 ## Markdown extras
 
 - **Footnotes** (GFM `[^1]` / `[^1]: text`) render as numbered superscript
-  links plus a `<section class="footnotes">` appended to the content.
+  links plus a `<section class="footnotes">` appended to the content. IDs are
+  limited to 256 characters, and malformed introducers are handled by a
+  monotonic scanner rather than repeated whole-suffix regex matching.
 - **Smart typography**: `--`/`---` become em dashes and straight quotes curl,
   in prose text only — code spans and blocks are never touched.
 - **Excerpts**: the home page (`indexLimit` most recent, default 20) and
@@ -130,6 +132,11 @@ GitHub-flavored, rendered by `marked`. Fenced code blocks are highlighted at
 build time by highlight.js (`lib/common` language set) into `hljs-*` classes —
 no client-side JS. Headings get slugified `id` anchors.
 
+Authored raw HTML remains enabled; this renderer is not a sanitizer. Treat
+schema-free collection/frontmatter fields and filename-derived slugs as
+untrusted when writing a JS page, and apply `escapeHtml(String(value))` in the
+correct HTML context.
+
 ## Theming
 
 Bundled themes: `juniper` (default), `salt`, `chalk`, `clay` — pick with
@@ -179,7 +186,7 @@ to the theme's CSS (after the `ui.css` aliases). Post URLs live under
 
 The output is a plain static directory — serve it from a Worker's assets
 binding (this is what `blog init --deploy cloudflare` will generate; a
-the public platform manual documents the same Worker + assets composition):
+the public machine-readable platform runbook documents the same Worker + assets composition):
 
 ```js
 // build-site.mjs — run before every deploy

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/blog",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "Minimal-dependency, static-first blogging platform. Files in, site out; odla-db lights up interactivity when configured.",
   "type": "module",
   "license": "MIT",
@@ -34,7 +34,7 @@
     "prepublishOnly": "npm run gen:llms && npm test"
   },
   "dependencies": {
-    "@odla-ai/ui": "^0.2.2",
+    "@odla-ai/ui": "^0.3.0",
     "highlight.js": "^11.11.0",
     "marked": "^16.0.0",
     "yaml": "^2.8.0"

package/src/markdown.js

@@ -32,6 +32,62 @@ export function slugify(text) {
 let footnoteNumbers = new Map(); // id → number, in first-reference order
 let footnoteBodies = new Map(); // id → rendered inline HTML
 let headingIds = new Map(); // base slug → occurrences in this document
+const MAX_FOOTNOTE_ID_LENGTH = 256;
+const footnoteWhitespace = /\s/u;
+
+// Return one syntactically valid reference at or after `from`. Both the search
+// cursor and every candidate cursor move only forward, while malformed IDs are
+// capped, so adversarial runs of "[^" remain linear in the input size.
+function findFootnoteReference(source, from = 0) {
+  let cursor = from;
+  while (cursor < source.length) {
+    const start = source.indexOf("[^", cursor);
+    if (start < 0) return;
+    const reference = parseFootnoteReference(source, start);
+    if (reference) return reference;
+    cursor = start + 2;
+  }
+}
+
+function parseFootnoteReference(source, start = 0) {
+  if (source[start] !== "[" || source[start + 1] !== "^") return;
+  const idEnd = footnoteIdEnd(source, start + 2);
+  if (idEnd === undefined || source[idEnd + 1] === ":") return;
+  return { index: start, id: source.slice(start + 2, idEnd), raw: source.slice(start, idEnd + 1) };
+}
+
+function footnoteIdEnd(source, start) {
+  for (let length = 0; start + length < source.length && length <= MAX_FOOTNOTE_ID_LENGTH; length++) {
+    const char = source[start + length];
+    if (char === "]") return length ? start + length : undefined;
+    if (footnoteWhitespace.test(char) || length === MAX_FOOTNOTE_ID_LENGTH) return;
+  }
+}
+
+// Parse a definition's first line and its ≥2-character horizontal-indent
+// continuation lines without a nested, backtracking regular expression.
+function parseFootnoteDefinition(source) {
+  if (!source.startsWith("[^")) return;
+  const idEnd = footnoteIdEnd(source, 2);
+  if (idEnd === undefined || source[idEnd + 1] !== ":") return;
+  let cursor = idEnd + 2;
+  while (source[cursor] === " " || source[cursor] === "\t") cursor++;
+  let lineEnd = source.indexOf("\n", cursor);
+  if (lineEnd < 0) lineEnd = source.length;
+  const body = [source.slice(cursor, lineEnd)];
+  let rawEnd = lineEnd;
+  while (lineEnd < source.length) {
+    const indentStart = lineEnd + 1;
+    let contentStart = indentStart;
+    while (source[contentStart] === " " || source[contentStart] === "\t") contentStart++;
+    if (contentStart - indentStart < 2) break;
+    lineEnd = source.indexOf("\n", contentStart);
+    if (lineEnd < 0) lineEnd = source.length;
+    body.push(source.slice(contentStart, lineEnd));
+    rawEnd = lineEnd;
+  }
+  return { id: source.slice(2, idEnd), raw: source.slice(0, rawEnd), text: body.join(" ").trim() };
+}
 
 function uniqueHeadingId(text) {
   const base = slugify(text);
@@ -47,10 +103,12 @@ const footnotes = {
       footnoteBodies = new Map();
       headingIds = new Map();
       // Number by first reference (definitions like "[^id]:" excluded).
-      for (const match of markdown.matchAll(/\[\^([^\]\s]+)\](?!:)/g)) {
-        if (!footnoteNumbers.has(match[1])) {
-          footnoteNumbers.set(match[1], footnoteNumbers.size + 1);
+      let reference = findFootnoteReference(markdown);
+      while (reference) {
+        if (!footnoteNumbers.has(reference.id)) {
+          footnoteNumbers.set(reference.id, footnoteNumbers.size + 1);
         }
+        reference = findFootnoteReference(markdown, reference.index + reference.raw.length);
       }
       return markdown;
     },
@@ -71,14 +129,13 @@ const footnotes = {
       level: "block",
       tokenizer(src) {
         // "[^id]: text" plus continuation lines indented ≥2 spaces.
-        const match = /^\[\^([^\]\s]+)\]:[ \t]*([^\n]*(?:\n[ \t]{2,}[^\n]*)*)/.exec(src);
-        if (!match) return;
-        const text = match[2].replace(/\n[ \t]+/g, " ").trim();
+        const definition = parseFootnoteDefinition(src);
+        if (!definition) return;
         return {
           type: "footnoteDef",
-          raw: match[0],
-          id: match[1],
-          tokens: this.lexer.inlineTokens(text),
+          raw: definition.raw,
+          id: definition.id,
+          tokens: this.lexer.inlineTokens(definition.text),
         };
       },
       renderer(token) {
@@ -95,10 +152,14 @@ const footnotes = {
         return src.indexOf("[^");
       },
       tokenizer(src) {
-        const match = /^\[\^([^\]\s]+)\](?!:)/.exec(src);
-        if (match && footnoteNumbers.has(match[1])) {
-          return { type: "footnoteRef", raw: match[0], id: match[1] };
+        if (!src.startsWith("[^")) return;
+        const reference = parseFootnoteReference(src);
+        if (reference && footnoteNumbers.has(reference.id)) {
+          return { type: "footnoteRef", raw: reference.raw, id: reference.id };
         }
+        // Consume the introducer as ordinary text. Returning here prevents
+        // Marked from retrying every malformed prefix against the whole suffix.
+        return { type: "text", raw: "[^", text: "[^" };
       },
       renderer(token) {
         const n = footnoteNumbers.get(token.id);