@readme/markdown 15.9.0 → 15.9.2

package/dist/render-fixture.node.js

@@ -16243,6 +16243,15 @@ function cloneSort(comparator) {
   return templateFn(comparator);
 }
 
+let isEvalAllowed = (function () {
+  try {
+    new Function('return 0')();
+    return true;
+  } catch {
+    return false;
+  }
+})();
+
 /**
  * Sort the given array in-place with the given comparator function.
  *
@@ -16254,7 +16263,7 @@ function cloneSort(comparator) {
 
 let sortCache = new WeakMap();
 exports.g = function (ary, comparator, start = 0) {
-  let doQuickSort = sortCache.get(comparator);
+  let doQuickSort = isEvalAllowed ? sortCache.get(comparator) : SortTemplate(comparator);
   if (doQuickSort === void 0) {
     doQuickSort = cloneSort(comparator);
     sortCache.set(comparator, doQuickSort);
@@ -16282,6 +16291,14 @@ var ArraySet = (__webpack_require__(4361)/* .ArraySet */ .C);
 var base64VLQ = __webpack_require__(582);
 var quickSort = (__webpack_require__(4951)/* .quickSort */ .g);
 
+// Upper bound for a section's `offset.line` in an indexed source map. A flat
+// map spends one ';' per generated line, so a tiny indexed map with a huge
+// offset.line turns into a huge amount of work and memory once its mappings
+// are copied into a SourceMapGenerator (CVE-2026-93749). Ten million lines is
+// far beyond any real generated file. Columns are VLQ-encoded as deltas and
+// don't amplify, so they only need to be valid integers.
+var MAX_SECTION_OFFSET_LINE = 1e7;
+
 function SourceMapConsumer(aSourceMap, aSourceMapURL) {
   var sourceMap = aSourceMap;
   if (typeof aSourceMap === 'string') {
@@ -17206,6 +17223,7 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     line: -1,
     column: 0
   };
+  var maxOffsetLine = 0;
   this._sections = sections.map(function (s) {
     if (s.url) {
       // The url field will require support for asynchronicity.
@@ -17216,12 +17234,32 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     var offsetLine = util.getArg(offset, 'line');
     var offsetColumn = util.getArg(offset, 'column');
 
+    if (!isValidOffset(offsetLine) || !isValidOffset(offsetColumn)) {
+      throw new Error('Section offset line and column must be non-negative integers.');
+    }
+    if (offsetLine > MAX_SECTION_OFFSET_LINE) {
+      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE + '.');
+    }
+
     if (offsetLine < lastOffset.line ||
         (offsetLine === lastOffset.line && offsetColumn < lastOffset.column)) {
       throw new Error('Section offsets must be ordered and non-overlapping.');
     }
     lastOffset = offset;
 
+    var consumer = new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL);
+
+    // Offsets of a nested indexed map add up with this one, so apply the
+    // bound to the total.
+    var totalOffsetLine = offsetLine + (consumer._maxOffsetLine || 0);
+    if (totalOffsetLine > MAX_SECTION_OFFSET_LINE) {
+      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE +
+                      ', including offsets of nested sections.');
+    }
+    if (totalOffsetLine > maxOffsetLine) {
+      maxOffsetLine = totalOffsetLine;
+    }
+
     return {
       generatedOffset: {
         // The offset fields are 0-based, but we use 1-based indices when
@@ -17229,9 +17267,24 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
         generatedLine: offsetLine + 1,
         generatedColumn: offsetColumn + 1
       },
-      consumer: new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL)
+      consumer: consumer
     }
   });
+
+  // The largest offset.line of any section, including nested sections.
+  this._maxOffsetLine = maxOffsetLine;
+}
+
+/**
+ * Section offsets come from untrusted input and are used as line/column
+ * numbers, so only accept non-negative safe integers (rejects NaN, Infinity,
+ * strings, fractions, etc).
+ */
+function isValidOffset(aValue) {
+  return typeof aValue === 'number' &&
+    aValue >= 0 &&
+    aValue <= 9007199254740991 && // Number.MAX_SAFE_INTEGER
+    Math.floor(aValue) === aValue;
 }
 
 IndexedSourceMapConsumer.prototype = Object.create(SourceMapConsumer.prototype);
@@ -17249,8 +17302,12 @@ Object.defineProperty(IndexedSourceMapConsumer.prototype, 'sources', {
   get: function () {
     var sources = [];
     for (var i = 0; i < this._sections.length; i++) {
-      for (var j = 0; j < this._sections[i].consumer.sources.length; j++) {
-        sources.push(this._sections[i].consumer.sources[j]);
+      // Read the getter once per section: for a nested indexed map it is
+      // itself this getter, and re-reading it per item is exponential in the
+      // nesting depth (CVE-2026-93749).
+      var sectionSources = this._sections[i].consumer.sources;
+      for (var j = 0; j < sectionSources.length; j++) {
+        sources.push(sectionSources[j]);
       }
     }
     return sources;
@@ -17814,10 +17871,12 @@ SourceMapGenerator.prototype._serializeMappings =
 
       if (mapping.generatedLine !== previousGeneratedLine) {
         previousGeneratedColumn = 0;
-        while (mapping.generatedLine !== previousGeneratedLine) {
-          next += ';';
-          previousGeneratedLine++;
-        }
+        // One ';' per skipped line. Build large gaps with a single flat
+        // string: appending ';' one by one creates a rope node per line, which
+        // can exhaust the heap for a big gap (CVE-2026-93749).
+        var lineDelta = mapping.generatedLine - previousGeneratedLine;
+        next += lineDelta === 1 ? ';' : ';'.repeat(lineDelta);
+        previousGeneratedLine = mapping.generatedLine;
       }
       else {
         if (i > 0) {
@@ -18031,6 +18090,13 @@ SourceNode.fromStringWithSourceMap =
       // to the SourceNode without any mapping.
       // Each line is added as separate string.
       while (lastGeneratedLine < mapping.generatedLine) {
+        if (remainingLinesIndex >= remainingLines.length) {
+          // The generated code is exhausted. Skip the rest instead of adding
+          // empty lines one by one: a mapping may point far past the end of
+          // the code (e.g. an indexed map section with a huge offset.line).
+          lastGeneratedLine = mapping.generatedLine;
+          break;
+        }
         node.add(shiftNextLine());
         lastGeneratedLine++;
       }
@@ -19045,7 +19111,7 @@ module.exports = function () {
 
 /***/ },
 
-/***/ 8900
+/***/ 1186
 (module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -68781,18 +68847,53 @@ function evaluate(source, scope = {}) {
     return new Function(...names, `return (${source})`)(...values);
 }
 /**
- * Advance a `Point` by the `consumed` substring that follows it, returning the
- * point at the consumed string's end. Lets split-out sub-nodes carry accurate
- * document positions so downstream offset shifting stays correct.
+ * Width each container prefix adds back per line of `value`, aligned from the line end since a
+ * tab in the prefix is expanded to spaces in `value`. None (a verbatim slice) when the source
+ * is missing or doesn't line up.
  */
-const pointAfter = (start, consumed) => {
-    const newlineIndex = consumed.lastIndexOf('\n');
-    const newlineCount = newlineIndex === -1 ? 0 : consumed.split('\n').length - 1;
-    return {
-        line: start.line + newlineCount,
-        // Same line → advance the base column; a later line → column is the run since its newline.
-        column: newlineCount === 0 ? start.column + consumed.length : consumed.length - newlineIndex,
-        offset: (start.offset ?? 0) + consumed.length,
+const containerPrefixWidths = (valueLines, source, position) => {
+    const sourceLines = source?.slice(position.start.offset, position.end.offset).split('\n');
+    const linesUp = sourceLines?.length === valueLines.length &&
+        sourceLines.every((line, i) => line.endsWith(valueLines[i].trimStart()));
+    return valueLines.map((line, i) => (linesUp ? sourceLines[i].length - line.length : 0));
+};
+/**
+ * Maps offsets in a node's `value` to points in `source`. Containers strip a prefix from every
+ * continuation line of `value`, so a plain offset shift drifts by line (CX-4028).
+ */
+const createValueToSourceMapper = (position, value, source) => {
+    if (position?.start.offset === undefined)
+        return null;
+    const { start } = position;
+    const valueLines = value.split('\n');
+    const prefixWidths = containerPrefixWidths(valueLines, source, position);
+    const lines = [];
+    let valueStart = 0;
+    let sourceStart = start.offset;
+    valueLines.forEach((line, i) => {
+        lines.push({ prefixWidth: prefixWidths[i], sourceStart, valueStart });
+        valueStart += line.length + 1;
+        sourceStart += prefixWidths[i] + line.length + 1;
+    });
+    return valueOffset => {
+        // Binary search: a large table maps one point per node.
+        let low = 0;
+        let high = lines.length - 1;
+        while (low < high) {
+            const mid = Math.ceil((low + high) / 2);
+            if (lines[mid].valueStart <= valueOffset)
+                low = mid;
+            else
+                high = mid - 1;
+        }
+        const { prefixWidth, sourceStart: lineSourceStart, valueStart: lineValueStart } = lines[low];
+        // Clamped: an expanded tab can make a leading-whitespace offset fall before the line.
+        const sourceColumn = Math.max(0, prefixWidth + valueOffset - lineValueStart);
+        return {
+            line: start.line + low,
+            column: (low === 0 ? start.column : 1) + sourceColumn,
+            offset: lineSourceStart + sourceColumn,
+        };
     };
 };
 /**
@@ -69455,7 +69556,9 @@ const processBlockquote = (node, index, parent, isMdxish = false) => {
         }
         Object.assign(node, {
             type: NodeTypes.callout,
+            // Keep the blockquote's data, e.g. the `reparseSource` its positions index into.
             data: {
+                ...node.data,
                 hName: 'Callout',
                 hProperties: {
                     icon,
@@ -69488,14 +69591,55 @@ const calloutTransformer = ({ isMdxish = false } = {}) => {
 };
 /* harmony default export */ const callouts = (calloutTransformer);
 
+;// ./processor/transform/mdxish/reparse-source.ts
+/**
+ * Mark re-parsed subtree roots with the string their positions index into, so consumers
+ * slicing by offset use the right source (see `Data.reparseSource`). Only roots are
+ * stamped; descendants resolve via their nearest stamped ancestor. Roots a deeper
+ * re-parse already stamped keep their own string.
+ */
+const stampReparseSource = (roots, reparseSource) => {
+    roots.forEach(root => {
+        if (!root.data?.reparseSource)
+            root.data = { ...root.data, reparseSource };
+    });
+};
+/**
+ * Splice `replacements` over `parent.children[index]`. They take over the replaced node's
+ * position, so they also take over the coordinate space that position indexes into.
+ */
+const replaceInheritingReparseSource = (parent, index, replacements) => {
+    const replacedSource = parent.children[index]?.data?.reparseSource;
+    if (replacedSource)
+        stampReparseSource(replacements, replacedSource);
+    parent.children.splice(index, 1, ...replacements);
+};
+/**
+ * The string `node`'s offsets index into: the nearest stamp on it or an ancestor, else the
+ * document source.
+ */
+const resolveReparseSource = (node, ancestors, documentSource) => {
+    if (node.data?.reparseSource)
+        return node.data.reparseSource;
+    for (let i = ancestors.length - 1; i >= 0; i -= 1) {
+        const { reparseSource } = ancestors[i].data ?? {};
+        if (reparseSource)
+            return reparseSource;
+    }
+    return documentSource;
+};
+
 ;// ./processor/transform/code-tabs.ts
 
 
+
 const isCode = (node) => node?.type === 'code';
 const codeTabsTransformer = ({ copyButtons } = {}) => (tree) => {
     visit(tree, 'code', (node) => {
         const { lang, meta, value } = node;
         node.data = {
+            // Ensure positions are passed through
+            ...node.data,
             hProperties: { lang, meta, value, copyButtons },
         };
     });
@@ -69542,6 +69686,9 @@ const codeTabsTransformer = ({ copyButtons } = {}) => (tree) => {
                 end: children[children.length - 1].position.end,
             },
         };
+        // Adjacent siblings share a coordinate space, so the wrapper takes the first block's.
+        if (node.data?.reparseSource)
+            stampReparseSource([codeTabs], node.data.reparseSource);
         parent.children.splice(index, children.length, codeTabs);
     });
     return tree;
@@ -92176,11 +92323,12 @@ const HTMLBlock = ({ children = '', html: htmlProp, runScripts, safeMode: safeMo
     // In MDX mode, safeMode is passed in as a boolean from JSX parsing
     // In MDXish mode, safeMode comes in as a string from HAST props
     const safeMode = typeof safeModeRaw !== 'boolean' ? safeModeRaw === 'true' : safeModeRaw;
-    const [cleanedHtml, exec] = extractScripts(html);
+    // Memoised so `exec` is stable across rerenders and the effect below only runs when the html changes.
+    const [cleanedHtml, exec] = (0,external_react_.useMemo)(() => extractScripts(html), [html]);
     (0,external_react_.useEffect)(() => {
-        if (typeof window !== 'undefined' && typeof runScripts === 'boolean' && runScripts && !safeMode)
+        if (typeof window !== 'undefined' && typeof runScripts === 'boolean' && runScripts)
             exec();
-    }, [runScripts, safeMode, exec]);
+    }, [runScripts, exec]);
     if (nonStringChildren) {
         // Fail soft: a non-string child (e.g. JSX that wasn't serialized back to a
         // raw string) should never throw, so render the child nodes directly
@@ -100237,6 +100385,7 @@ const walkTags = (html, handlers) => {
 };
 
 ;// ./processor/transform/mdxish/tables/utils.ts
+
 const tableTags = new Set([
     'thead',
     'tbody',
@@ -100255,6 +100404,9 @@ const tableTags = new Set([
 const unwrapParagraphNodes = (children) => {
     return children.flatMap(child => {
         if (child.type === 'paragraph' && 'children' in child && Array.isArray(child.children)) {
+            // The unwrap drops a stamped root, so its children inherit that coordinate space.
+            if (child.data?.reparseSource)
+                stampReparseSource(child.children, child.data.reparseSource);
             return child.children;
         }
         return [child];
@@ -100850,9 +101002,10 @@ const findTableRanges = (html) => {
  * The surrounding raw HTML (the wrapper's open/close tags) would be re-nested
  * around the parsed tables by rehype-raw.
  *
- * Returns null when there is no wrapped table to extract.
+ * Returns null when there is no wrapped table to extract. `source` is the string the node's
+ * positions index into, so the parts' positions survive stripped container prefixes.
  */
-const splitHtmlWithNestedTables = (node) => {
+const splitHtmlWithNestedTables = (node, source) => {
     const { value } = node;
     // This is a top-level table, so we don't need to split it
     if (TOP_LEVEL_TABLE_TAG_RE.test(value))
@@ -100865,13 +101018,11 @@ const splitHtmlWithNestedTables = (node) => {
     const ranges = findTableRanges(value);
     if (ranges.length === 0)
         return null;
-    const base = node.position?.start;
+    const toSourcePoint = createValueToSourceMapper(node.position, value, source);
     const sliceToHtml = (from, to) => ({
         type: 'html',
         value: value.slice(from, to),
-        ...(base && {
-            position: { start: pointAfter(base, value.slice(0, from)), end: pointAfter(base, value.slice(0, to)) },
-        }),
+        ...(toSourcePoint && { position: { start: toSourcePoint(from), end: toSourcePoint(to) } }),
     });
     const parts = [];
     let cursor = 0;
@@ -100906,6 +101057,8 @@ const splitHtmlWithNestedTables = (node) => {
 
 
 
+
+
 
 
 
@@ -100958,7 +101111,7 @@ const tableRepairs = [
  * The plugins in the processor allows parsing markdown & special syntax inside the table cells
  * After parsing, we need to update the node positions
  */
-const parseTableNode = (processor, node, repair) => {
+const parseTableNode = (processor, node, source, repair) => {
     let parsed;
     try {
         parsed = processor.runSync(processor.parse(node.value));
@@ -100972,19 +101125,18 @@ const parseTableNode = (processor, node, repair) => {
     if (repair) {
         remapPositionsThroughLayers(parsed, repair.originalSource, repair.layers);
     }
-    // The subparser produces positions relative to `node.value`; shift them by
-    // the outer node's offset/line so consumers can slice the full source.
-    const baseOffset = node.position?.start?.offset ?? 0;
-    const baseLine = (node.position?.start?.line ?? 1) - 1;
+    // The subparser produces positions relative to `node.value`; map them into
+    // the outer source so consumers can slice it.
+    const toSourcePoint = createValueToSourceMapper(node.position, repair?.originalSource ?? node.value, source);
+    if (!toSourcePoint)
+        return parsed;
     visit(parsed, child => {
-        if (child.position?.start) {
-            child.position.start.offset = (child.position.start.offset ?? 0) + baseOffset;
-            child.position.start.line += baseLine;
-        }
-        if (child.position?.end) {
-            child.position.end.offset = (child.position.end.offset ?? 0) + baseOffset;
-            child.position.end.line += baseLine;
-        }
+        if (!child.position)
+            return;
+        child.position = {
+            start: toSourcePoint(child.position.start.offset ?? 0),
+            end: toSourcePoint(child.position.end.offset ?? 0),
+        };
     });
     return parsed;
 };
@@ -101014,12 +101166,10 @@ const hasFlowContent = (nodes) => {
     return nodes.some(node => !phrasing(node) && node.type !== 'paragraph');
 };
 /**
- * Process a Table node: re-parse text-only cell content, then output as
- * a markdown table (phrasing-only) or keep as JSX <Table> (has flow content).
+ * Process a Table node: re-parse text-only cell content, then return it as
+ * a markdown table (phrasing-only) or keep it as JSX <Table> (has flow content).
  */
-const processTableNode = (node, index, parent, documentPosition) => {
-    if (node.name !== 'Table' && node.name !== 'table')
-        return;
+const processTableNode = (node, documentPosition) => {
     const position = documentPosition ?? node.position;
     const { align: alignAttr } = getAttrs(node);
     const align = Array.isArray(alignAttr) ? alignAttr : null;
@@ -101046,6 +101196,8 @@ const processTableNode = (node, index, parent, documentPosition) => {
         try {
             const parsed = tableNodeProcessor.runSync(tableNodeProcessor.parse(textContent));
             if (parsed.children.length > 0) {
+                // Positions index into the extracted text rather than the table source (CX-4004).
+                stampReparseSource(parsed.children, textContent);
                 cell.children = parsed.children;
                 if (hasFlowContent(parsed.children)) {
                     tableHasFlowContent = true;
@@ -101088,11 +101240,7 @@ const processTableNode = (node, index, parent, documentPosition) => {
                 : unwrapParagraphNodes(el.children);
             el.children = removeWhitespaceOnlyTextNodes(unwrapped);
         });
-        parent.children[index] = {
-            ...node,
-            position,
-        };
-        return;
+        return { ...node, position };
     }
     // All cells are phrasing-only — convert to markdown table
     const children = [];
@@ -101170,7 +101318,7 @@ const processTableNode = (node, index, parent, documentPosition) => {
     const alignArray = align && columnCount > 0
         ? align.slice(0, columnCount).concat(new Array(Math.max(0, columnCount - align.length)).fill(null))
         : new Array(columnCount).fill(null);
-    const mdNode = {
+    return {
         align: alignArray,
         type: 'table',
         position,
@@ -101178,14 +101326,13 @@ const processTableNode = (node, index, parent, documentPosition) => {
         // Remember the author's spelling so the serializer can write `<table>` back instead of `<Table>`
         ...(node.name === 'table' && { data: { lowercaseTable: true } }),
     };
-    parent.children[index] = mdNode;
 };
 /**
  * Apply `tableRepairs` cumulatively, re-parsing after every change and stopping
  * once the accumulated result parses. Each layer's inserts are relative to the
  * string that repair received, so they stay ordered for position remapping.
  */
-const repairAndReparse = (node) => {
+const repairAndReparse = (node, source) => {
     let repairedValue = node.value;
     const layers = [];
     let parsed;
@@ -101195,11 +101342,45 @@ const repairAndReparse = (node) => {
             return false;
         repairedValue = value;
         layers.push(inserts);
-        parsed = parseTableNode(tableNodeProcessor, { ...node, value: repairedValue }, { layers, originalSource: node.value });
+        parsed = parseTableNode(tableNodeProcessor, { ...node, value: repairedValue }, source, {
+            layers,
+            originalSource: node.value,
+        });
         return Boolean(parsed);
     });
     return parsed;
 };
+/**
+ * Re-parse a table html node and replace it with a markdown / JSX table, or the
+ * fallback parse's fragments for a lowercase table mdxjs rejects.
+ */
+const replaceTableHtml = (node, index, parent, source) => {
+    // Because the processor uses remarkMdx, it is stricter in what it accepts
+    // and only accepts valid MDX syntax in the table node. To get around that,
+    // fall back to the cumulative repairs when the first parse fails.
+    const parsed = parseTableNode(tableNodeProcessor, node, source) ?? repairAndReparse(node, source);
+    if (parsed) {
+        // If the table is parsed successfully, we can now process it further
+        // to build on the markdown / JSX table
+        visit(parsed, isMDXElement, (tableNode) => {
+            if (tableNode.name !== 'Table' && tableNode.name !== 'table')
+                return undefined;
+            replaceInheritingReparseSource(parent, index, [processTableNode(tableNode, node.position)]);
+            return (/* inlined export .EXIT */false);
+        });
+    }
+    else if (node.value.startsWith('<table')) {
+        // If the parsing still fails, give an opportunity to the fallback parser
+        // without remarkMdx to process lowercase tables as it's likely to not
+        // have needed MDX parsing anyway
+        const fallback = parseTableNode(fallbackTableNodeProcessor, node, source);
+        if (!fallback || fallback.children.length <= 1)
+            return;
+        replaceInheritingReparseSource(parent, index, fallback.children);
+    }
+    // Otherwise, there's no point in trying to parse the table content further
+    // More repairs are needed in that case
+};
 /**
  * Converts JSX Table elements to markdown table nodes and re-parses markdown in cells.
  *
@@ -101211,24 +101392,26 @@ const repairAndReparse = (node) => {
  * When cell content contains block-level nodes (callouts, code blocks, etc.), the table
  * is kept as a JSX <Table> element so that remarkRehype can properly handle the flow content.
  */
-const mdxishTables = () => tree => {
+const mdxishTables = () => (tree, file) => {
+    // Positions index into the document unless a re-parse stamped another source.
+    const documentSource = file?.value ? String(file.value) : undefined;
     // Pre-pass: lift `<table>`s wrapped in a raw HTML block out into their own
     // html nodes so the main pass below treats them like top-level tables.
-    visit(tree, 'html', (_node, index, parent) => {
-        const node = _node;
-        if (typeof index !== 'number' || !parent || !('children' in parent))
+    visitParents(tree, 'html', (node, ancestors) => {
+        const parent = ancestors[ancestors.length - 1];
+        if (!parent)
             return;
-        const parts = splitHtmlWithNestedTables(node);
+        const parts = splitHtmlWithNestedTables(node, resolveReparseSource(node, ancestors, documentSource));
         if (!parts)
             return;
         // The inserted parts can't re-trigger a split (table parts start with
         // `<table`; the wrapper slices hold no table), so plain in-place splicing
         // visits each once without looping.
-        parent.children.splice(index, 1, ...parts);
+        replaceInheritingReparseSource(parent, parent.children.indexOf(node), parts);
     });
-    visit(tree, 'html', (_node, index, parent) => {
-        const node = _node;
-        if (typeof index !== 'number' || !parent || !('children' in parent))
+    visitParents(tree, 'html', (node, ancestors) => {
+        const parent = ancestors[ancestors.length - 1];
+        if (!parent)
             return;
         if (!node.value.startsWith('<Table') && !node.value.startsWith('<table'))
             return;
@@ -101236,33 +101419,8 @@ const mdxishTables = () => tree => {
         // paragraph. Leave them untouched so rehype-raw can reassemble the table.
         if (parent.type === 'paragraph')
             return;
-        // Because the processor uses remarkMdx, it is stricter in what it accepts
-        // and only accepts valid MDX syntax in the table node. To get around that,
-        // fall back to the cumulative repairs when the first parse fails.
-        const parsed = parseTableNode(tableNodeProcessor, node) ?? repairAndReparse(node);
-        if (parsed) {
-            // If the table is parsed successfully, we can now process it further
-            // to build on the markdown / JSX table
-            visit(parsed, isMDXElement, (tableNode) => {
-                if (tableNode.name !== 'Table' && tableNode.name !== 'table')
-                    return undefined;
-                processTableNode(tableNode, index, parent, node.position);
-                return (/* inlined export .EXIT */false);
-            });
-        }
-        else if (node.value.startsWith('<table')) {
-            // If the parsing still fails, give an opportunity to the fallback parser
-            // without remarkMdx to process lowercase tables as it's likely to not
-            // have needed MDX parsing anyway
-            const fallback = parseTableNode(fallbackTableNodeProcessor, node);
-            if (!fallback || fallback.children.length <= 1)
-                return;
-            parent.children.splice(index, 1, ...fallback.children);
-        }
-        // Otherwise, there's no point in trying to parse the table content further
-        // More repairs are needed in that case
+        replaceTableHtml(node, parent.children.indexOf(node), parent, resolveReparseSource(node, ancestors, documentSource));
     });
-    return tree;
 };
 /* harmony default export */ const mdxish_tables = (mdxishTables);
 
@@ -122425,32 +122583,6 @@ const mdxComponentHandlers = {
     [NodeTypes.htmlBlock]: htmlBlockHandler,
 };
 
-;// ./processor/plugin/safe-mode-html-blocks.ts
-
-
-/**
- * Whether a tag name renders through the `HTMLBlock` component. Mirrors the
- * separator-agnostic, case-insensitive lookup in `getComponentName` and the
- * rehype-react component map, so `html-block`, `HTMLBlock`, `HtmlBlock` and
- * `htmlblock` all match.
- */
-const isHtmlBlockTag = (tagName) => toPascalCase(tagName).toLowerCase() === 'htmlblock';
-/**
- * Forces `safeMode` on every element that renders through `HTMLBlock` so it is
- * shown as escaped text instead of injected.
- *
- * Runs last, so it sees every producer of the element — `[block:html]`,
- * `<HTMLBlock>` with a template body or an `html` attribute, and a literal
- * `<html-block>` — and it is unconditional so an author-supplied
- * `safeMode="false"` can't opt out.
- */
-const enforceSafeModeHtmlBlocks = () => tree => {
-    visit(tree, 'element', node => {
-        if (isHtmlBlockTag(node.tagName))
-            node.properties.safeMode = 'true';
-    });
-};
-
 ;// ./processor/transform/mdxish/anchor-to-jsx.ts
 /* unused harmony import specifier */ var anchor_to_jsx_visit;
 /* unused harmony import specifier */ var anchor_to_jsx_NodeTypes;
@@ -122490,7 +122622,6 @@ const mdxishAnchorToJsx = () => tree => {
 
 ;// ./processor/transform/mdxish/callout-to-jsx.ts
 /* unused harmony import specifier */ var callout_to_jsx_visit;
-/* unused harmony import specifier */ var callout_to_jsx_defaultIcons;
 /* unused harmony import specifier */ var callout_to_jsx_themes;
 /* unused harmony import specifier */ var callout_to_jsx_NodeTypes;
 /* unused harmony import specifier */ var callout_to_jsx_toAttributes;
@@ -122513,9 +122644,9 @@ const mdxishCalloutToJsx = () => tree => {
     callout_to_jsx_visit(tree, callout_to_jsx_NodeTypes.callout, (node, index, parent) => {
         if (!parent || index === undefined)
             return;
-        let { icon, theme } = node.data.hProperties;
-        if (!icon && theme)
-            icon = callout_to_jsx_defaultIcons[theme];
+        // No default-icon fill: an empty `icon` means the author removed it
+        const { icon } = node.data.hProperties;
+        let { theme } = node.data.hProperties;
         if (!theme && icon)
             theme = callout_to_jsx_themes[icon] || 'default';
         // Mutate in place to keep the children array identity so nested callouts in
@@ -123066,18 +123197,6 @@ const getInlineMdProcessor = ({ safeMode = false } = {}) => {
     }
     return processor;
 };
-/**
- * Mark re-parsed subtree roots with the string their positions index into, so consumers
- * slicing by offset use the right source (see `Data.reparseSource`). Only roots are
- * stamped; descendants resolve via their nearest stamped ancestor. Roots a deeper
- * re-parse already stamped keep their own string.
- */
-const stampReparseSource = (roots, reparseSource) => {
-    roots.forEach(root => {
-        if (!root.data?.reparseSource)
-            root.data = { ...root.data, reparseSource };
-    });
-};
 /**
  * True when a tag name starts with an uppercase letter — ReadMe's marker for
  * a custom MDX component (vs a lowercase HTML tag).
@@ -123164,6 +123283,7 @@ function findBalancedClosingTagIndex(content, tag) {
 
 
 
+
 /**
  * Parse the body of an inline component as phrasing content. Remark always
  * wraps bare text in a paragraph; flatten that single-paragraph wrapper so
@@ -123415,6 +123535,7 @@ function terminateHtmlFlowBlocks(content) {
 
 
 
+
 // Matches a JSX attribute expression (e.g. `key={i}`) anywhere in a string. One name
 // char suffices for existence — `[\w-]+` backtracked quadratically over huge attributes.
 const NESTED_ATTR_EXPRESSION_RE = /[\w-]\s*=\s*\{/;
@@ -123496,26 +123617,12 @@ const parseSibling = (parent, index, sibling, safeMode, promoted) => {
     }
 };
 // Ends the position at `consumedLength` so the component doesn't claim trailing
-// content the tokenizer swallowed into the same html node. Measured against the source
-// when available: each value line is its source line minus the container prefix
-// (list indent, `> `) micromark stripped, so those prefixes are counted back in.
+// content the tokenizer swallowed into the same html node.
 const positionEndingAtConsumed = (nodePosition, value, consumedLength, source) => {
-    if (!nodePosition?.start)
+    const toSourcePoint = createValueToSourceMapper(nodePosition, value, source);
+    if (!nodePosition || !toSourcePoint)
         return nodePosition;
-    const consumedValue = value.slice(0, consumedLength);
-    const sourceLines = source?.slice(nodePosition.start.offset, nodePosition.end?.offset).split('\n');
-    const valueLines = value.split('\n');
-    if (!sourceLines || sourceLines.length !== valueLines.length) {
-        return { start: nodePosition.start, end: pointAfter(nodePosition.start, consumedValue) };
-    }
-    const consumedLines = consumedValue.split('\n');
-    const lastLineIndex = consumedLines.length - 1;
-    const prefixWidth = sourceLines[lastLineIndex].length - valueLines[lastLineIndex].length;
-    const consumedSource = [
-        ...sourceLines.slice(0, lastLineIndex),
-        sourceLines[lastLineIndex].slice(0, prefixWidth + consumedLines[lastLineIndex].length),
-    ].join('\n');
-    return { start: nodePosition.start, end: pointAfter(nodePosition.start, consumedSource) };
+    return { start: nodePosition.start, end: toSourcePoint(consumedLength) };
 };
 const createComponentNode = ({ tag, attributes, children, startPosition, endPosition, }) => ({
     type: 'mdxJsxFlowElement',
@@ -123527,14 +123634,6 @@ const createComponentNode = ({ tag, attributes, children, startPosition, endPosi
         end: endPosition?.end ?? startPosition?.end,
     },
 });
-// The promoted node takes over the html node's position, so it also takes over the
-// coordinate space that position belongs to.
-const substituteNodeWithMdxNode = (parent, index, mdxNode) => {
-    const replacedSource = parent.children[index]?.data?.reparseSource;
-    if (replacedSource)
-        stampReparseSource([mdxNode], replacedSource);
-    parent.children.splice(index, 1, mdxNode);
-};
 /**
  * Transform PascalCase HTML nodes into mdxJsxFlowElement nodes.
  *
@@ -123633,7 +123732,7 @@ function promoteComponentBlocks(tree, safeMode, source) {
                     ? positionEndingAtConsumed(node.position, value, leadingWhitespace + openingTagEnd, source)
                     : node.position,
             });
-            substituteNodeWithMdxNode(parent, index, componentNode);
+            replaceInheritingReparseSource(parent, index, [componentNode]);
             if (remainingContent) {
                 parseSibling(parent, index, remainingContent, safeMode, promoted);
             }
@@ -123684,7 +123783,7 @@ function promoteComponentBlocks(tree, safeMode, source) {
                 startPosition: node.position,
                 endPosition,
             });
-            substituteNodeWithMdxNode(parent, index, componentNode);
+            replaceInheritingReparseSource(parent, index, [componentNode]);
             // The unwrap reparented the children out of their paragraph, so re-walk them
             // since the children HTML may contain promotable syntax (e.g. `{…}`-attr tags)
             if (unwrappedSoleParagraph) {
@@ -126173,7 +126272,7 @@ const parseApiHeaderTitle = (text) => {
  * Transform a magicBlock node into final MDAST nodes.
  */
 function transformMagicBlock(blockType, data, rawValue, options = {}) {
-    const { compatibilityMode = false, hardBreaks = true } = options;
+    const { compatibilityMode = false, hardBreaks = true, safeMode = false } = options;
     // Handle empty data by returning placeholder nodes for known block types
     // This allows the editor to show appropriate placeholder UI instead of nothing
     if (Object.keys(data).length < 1) {
@@ -126391,7 +126490,7 @@ function transformMagicBlock(blockType, data, rawValue, options = {}) {
                 wrapPinnedBlocks({
                     data: {
                         hName: 'html-block',
-                        hProperties: { html: htmlJson.html, runScripts: compatibilityMode },
+                        hProperties: { html: htmlJson.html, runScripts: compatibilityMode, safeMode },
                     },
                     type: 'html-block',
                 }, data),
@@ -126532,6 +126631,7 @@ const magicBlockTransformer = (options = {}) => tree => {
 
 
 
+
 // `<HTMLBlock …>{`…`}</HTMLBlock>` embedded inside a raw HTML block (e.g. a
 // single-line `<div>…</div>`). CommonMark slurps the whole div as one `html`
 // node, so the tokenizer never sees the HTMLBlock — we recover it here.
@@ -126638,7 +126738,8 @@ const mdxishHtmlBlocks = () => tree => {
             return;
         const exprChild = element.children.find(child => child.type === 'mdxFlowExpression' || child.type === 'mdxTextExpression');
         const openingTagIndent = (element.position?.start.column ?? 1) - 1;
-        parent.children[index] = createHtmlBlockNode(formatHtmlForMdxish(extractTemplateLiteral(exprChild?.value), openingTagIndent), element.position, toRunScripts(jsxAttr(element, 'runScripts')), jsxAttr(element, 'safeMode'));
+        const htmlBlock = createHtmlBlockNode(formatHtmlForMdxish(extractTemplateLiteral(exprChild?.value), openingTagIndent), element.position, toRunScripts(jsxAttr(element, 'runScripts')), jsxAttr(element, 'safeMode'));
+        replaceInheritingReparseSource(parent, index, [htmlBlock]);
     });
     // Shape 2: raw HTML blob.
     visit(tree, 'html', (node, index, parent) => {
@@ -126646,7 +126747,7 @@ const mdxishHtmlBlocks = () => tree => {
             return;
         const replacement = splitRawHtmlBlocks(node);
         if (replacement)
-            parent.children.splice(index, 1, ...replacement);
+            replaceInheritingReparseSource(parent, index, replacement);
     });
 };
 /* harmony default export */ const mdxish_html_blocks = (mdxishHtmlBlocks);
@@ -126733,6 +126834,7 @@ const hasOnlyWidthAttributes = (cell) => {
 
 
 
+
 function toImageAlign(value) {
     if (value === 'left' || value === 'center' || value === 'right') {
         return value;
@@ -126948,6 +127050,15 @@ const transformAnchor = (jsx) => {
         position: jsx.position,
     };
 };
+/**
+ * Parses an image caption's markdown. The caption is re-parsed on its own, so the
+ * children's positions index into it rather than the document.
+ */
+const parseCaptionChildren = (caption) => {
+    const { children } = lib_mdast(caption);
+    stampReparseSource(children, caption);
+    return children;
+};
 /**
  * Transforms an `<Image />` JSX element into an image-block MDAST node.
  * Normalizes attributes (align, border, width→sizing) and parses caption markdown into children.
@@ -126978,7 +127089,7 @@ const transformImage = (jsx) => {
         alt,
         border: toBool(border),
         caption,
-        children: caption ? lib_mdast(caption).children : [],
+        children: caption ? parseCaptionChildren(caption) : [],
         className,
         framed: toBool(framed),
         height: height !== undefined ? String(height) : undefined,
@@ -127315,8 +127426,7 @@ const mdxishJsxToMdast = () => tree => {
         const newNode = transformer(node);
         if (!newNode)
             return;
-        // Replace the JSX node with the MDAST node
-        parent.children[index] = newNode;
+        replaceInheritingReparseSource(parent, index, [newNode]);
     });
     // Inline JSX components (Anchor)
     visit(tree, 'mdxJsxTextElement', (node, index, parent) => {
@@ -128172,7 +128282,6 @@ function loadComponents() {
 
 
 
-
 
 
 const defaultTransformers = [
@@ -128328,8 +128437,7 @@ function mdxish(mdContent, opts = {}) {
         .use(rehypeMdxishComponents, {
         components,
         processMarkdown: (markdown) => mdxish(markdown, opts),
-    })
-        .use(safeMode ? enforceSafeModeHtmlBlocks : undefined); // Force safeMode on every HTMLBlock; runs last so every producer is covered
+    });
     const vfile = new VFile({ value: parserReadyContent });
     const mdast = processor.parse(parserReadyContent);
     const hast = processor.runSync(mdast, vfile);
@@ -129405,7 +129513,7 @@ module.exports = /*#__PURE__*/JSON.parse('{"*":["about","acceptCharset","accessK
 /******/ 	// startup
 /******/ 	// Load entry module and return exports
 /******/ 	// This entry module used 'module' so it can't be inlined
-/******/ 	let __webpack_exports__ = __webpack_require__(8900);
+/******/ 	let __webpack_exports__ = __webpack_require__(1186);
 /******/ 	module.exports = __webpack_exports__;
 /******/ 	
 /******/ })()