@readme/markdown 15.9.2 → 15.9.3

package/dist/lib/constants.d.ts

@@ -56,3 +56,5 @@ export declare const TOKENIZER_MDX_COMPONENT_EXCLUDED_TAGS: Set<string>;
  * run after rehype (where hast `tagName` is normalized to lowercase).
  */
 export declare const INLINE_COMPONENT_TAGS_LOWER: Set<string>;
+/** Raw markup props injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed; never interpolate reader values. */
+export declare const RAW_HTML_PROP_NAMES: Set<string>;

package/dist/lib/utils/mdxish/mdxish-variables.d.ts

@@ -6,3 +6,5 @@
  * an MDX surface, and `{user.*}` is the syntax authors use there.
  */
 export declare function resolveAttributeVariables(value: string, user: Record<string, unknown>): string;
+/** Whether an attribute expression's source is a bare `user.*` reference, left for render-time substitution. */
+export declare const isBareVariableReference: (source: string) => boolean;

package/dist/main.js

@@ -13191,6 +13191,8 @@ const TOKENIZER_MDX_COMPONENT_EXCLUDED_TAGS = new Set([
  * run after rehype (where hast `tagName` is normalized to lowercase).
  */
 const INLINE_COMPONENT_TAGS_LOWER = new Set([...INLINE_COMPONENT_TAGS].map(t => t.toLowerCase()));
+/** Raw markup props injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed; never interpolate reader values. */
+const RAW_HTML_PROP_NAMES = new Set(['html']);
 
 ;// ./node_modules/github-slugger/regex.js
 // This module is generated by `script/`.
@@ -107775,33 +107777,75 @@ function repairMistakenTableClosers(content) {
     return applyInserts(content, edits).value;
 }
 
+;// ./lib/utils/mdxish/mdxish-variables.ts
+
+
+// The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
+// substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
+// which either evaluated already or is meant to stay literal.
+const MDX_VARIABLE_REGEX = new RegExp(`(?<!\\$)${variable_.MDX_VARIABLE_REGEXP}`, 'gu');
+// A whole attribute expression that is one `user.*` reference, e.g. the `user.name` in `title={user.name}`.
+const BARE_VARIABLE_REGEX = new RegExp(`^${variable_.MDX_VARIABLE_REGEXP}$`, 'u');
+// Bracket notation names the same variable as dot notation, so normalize it before substituting.
+// Escaped and `$`-prefixed forms are left alone so a reference that stays literal keeps its source.
+// A closing escape needs no lookahead: requiring a literal `]}` already rules out `]\}`.
+const BRACKET_NOTATION_REGEX = /(?<![$\\])\{user\[['"](\w+)['"]\]\}/gu;
+/**
+ * Resolve `{user.*}` in a JSX attribute value against the same `user` binding the rmdx engine gets,
+ * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
+ *
+ * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
+ * an MDX surface, and `{user.*}` is the syntax authors use there.
+ */
+function resolveAttributeVariables(value, user) {
+    if (!value.includes('{user'))
+        return value;
+    return value
+        .replace(BRACKET_NOTATION_REGEX, '{user.$1}')
+        .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
+        if (escapePrefix || escapeSuffix)
+            return source;
+        return stringifyVariableValue(user[name]);
+    });
+}
+/** Whether an attribute expression's source is a bare `user.*` reference, left for render-time substitution. */
+const isBareVariableReference = (source) => BARE_VARIABLE_REGEX.test(`{${source.trim()}}`.replace(BRACKET_NOTATION_REGEX, '{user.$1}'));
+
 ;// ./processor/transform/mdxish/resolve-deferred-attribute-expression-props.ts
 
 
 
 
+
+
+
 /**
  * Resolve attribute expressions that `mdxJsxElementHandler` deferred.
  *
  * The handler stashed each attribute expression's source in `node.data.deferredExpressions`
  * (keyed by prop name) instead of evaluating eagerly, because an eager result can be a React
  * element or function that rehypeRaw's `structuredClone` passthrough rejects. Now that we're
- * past the clone, evaluate each source with a scope of `{ React, ...mdxishScope }` and write
+ * past the clone, evaluate each source with a scope of `{ user, React, ...mdxishScope }` and write
  * the real value into `properties` (e.g. an array of objects whose fields are React elements).
  *
  * Must run after `rehypeRaw` (past the clone) but before `normalizeMdxJsxNodes` rewrites these
  * `mdx-jsx` nodes into plain elements. Skipped in safeMode, which keeps expressions literal.
  */
-const resolveDeferredAttributeExpressionProps = () => (tree, file) => {
+const resolveDeferredAttributeExpressionProps = ({ variables } = {}) => (tree, file) => {
     const scope = { ...file.data.mdxishScope, React: (external_amd_react_commonjs_react_commonjs2_react_root_React_umd_react_default()) };
+    // `user` only when variables were supplied, as in `evaluateExpressions`.
+    const userScope = variables ? { user: user(variables), ...scope } : scope;
     visit(tree, 'mdx-jsx', (node) => {
         const deferredExpressions = node.data?.deferredExpressions;
         if (!deferredExpressions)
             return;
         const properties = node.properties;
         Object.entries(deferredExpressions).forEach(([name, source]) => {
+            // Raw markup never gets `user`: a reader's values reaching `dangerouslySetInnerHTML` is an injection
+            // vector. A bare `{user.x}` keeps render-time substitution, which stringifies structured values.
+            const canReadUser = !RAW_HTML_PROP_NAMES.has(name) && !isBareVariableReference(source);
             try {
-                const result = evalExpression(source, scope);
+                const result = evalExpression(source, canReadUser ? userScope : scope);
                 // hast/HTML `style` is a plain CSS string; a `style={{...}}` expression evaluates to
                 // a JS object, which must be serialized or it renders as the literal "[object Object]".
                 properties[name] = name === 'style' && style_object_to_css_isPlainObject(result) ? styleObjectToCssText(result) : result;
@@ -108465,7 +108509,7 @@ function mdxish(mdContent, opts = {}) {
         .use(preserveBooleanProperties) // RehypeRaw converts boolean properties to empty strings
         .use(rehypeRaw, { passThrough: ['html-block', 'mdx-jsx'] }) // MDX JSX nodes bypass parse5's string-only HTML round-trip
         .use(restoreBooleanProperties)
-        .use(safeMode ? undefined : resolve_deferred_attribute_expression_props) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
+        .use(safeMode ? undefined : resolve_deferred_attribute_expression_props, { variables }) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
         .use(normalize_mdx_jsx_nodes) // Rewrite `mdx-jsx` back to standard `element` nodes for downstream plugins
         .use(sanitize ? rehypeStripTags : undefined) // Strip STRIPPED_TAG_NAMES elements; this pipeline has no sanitization step
         .use(rehypeFlattenTableCellParagraphs) // Remove <p> wrappers inside table cells to prevent margin issues
@@ -108671,36 +108715,6 @@ const makeUseMDXComponents = (more = {}) => {
 };
 /* harmony default export */ const makeUseMdxComponents = (makeUseMDXComponents);
 
-;// ./lib/utils/mdxish/mdxish-variables.ts
-
-
-// The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
-// substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
-// which either evaluated already or is meant to stay literal.
-const MDX_VARIABLE_REGEX = new RegExp(`(?<!\\$)${variable_.MDX_VARIABLE_REGEXP}`, 'gu');
-// Bracket notation names the same variable as dot notation, so normalize it before substituting.
-// Escaped and `$`-prefixed forms are left alone so a reference that stays literal keeps its source.
-// A closing escape needs no lookahead: requiring a literal `]}` already rules out `]\}`.
-const BRACKET_NOTATION_REGEX = /(?<![$\\])\{user\[['"](\w+)['"]\]\}/gu;
-/**
- * Resolve `{user.*}` in a JSX attribute value against the same `user` binding the rmdx engine gets,
- * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
- *
- * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
- * an MDX surface, and `{user.*}` is the syntax authors use there.
- */
-function resolveAttributeVariables(value, user) {
-    if (!value.includes('{user'))
-        return value;
-    return value
-        .replace(BRACKET_NOTATION_REGEX, '{user.$1}')
-        .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
-        if (escapePrefix || escapeSuffix)
-            return source;
-        return stringifyVariableValue(user[name]);
-    });
-}
-
 ;// ./lib/utils/mdxish/mdxish-render-utils.tsx
 
 
@@ -108711,6 +108725,7 @@ function resolveAttributeVariables(value, user) {
 
 
 
+
 /** Flatten CustomComponents into a component map for rehype-react */
 function exportComponentsForRehype(components) {
     const exported = Object.entries(components).reduce((memo, [tag, mod]) => {
@@ -108743,8 +108758,6 @@ function exportComponentsForRehype(components) {
  * deliberately leaves mermaid alone; resolving it again here would override that.
  */
 const CODE_TAG_NAMES = new Set(['code']);
-/** Raw markup injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed — never interpolate. */
-const RAW_HTML_PROP_NAMES = new Set(['html']);
 /**
  * Resolve `{user.*}` in string-valued props. Body text is handled by the `Variable` component, but
  * attributes are plain strings, so they are substituted here — at render time, so that a

package/dist/main.node.js

@@ -25789,6 +25789,8 @@ const TOKENIZER_MDX_COMPONENT_EXCLUDED_TAGS = new Set([
  * run after rehype (where hast `tagName` is normalized to lowercase).
  */
 const INLINE_COMPONENT_TAGS_LOWER = new Set([...INLINE_COMPONENT_TAGS].map(t => t.toLowerCase()));
+/** Raw markup props injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed; never interpolate reader values. */
+const RAW_HTML_PROP_NAMES = new Set(['html']);
 
 ;// ./node_modules/github-slugger/regex.js
 // This module is generated by `script/`.
@@ -128024,33 +128026,75 @@ function repairMistakenTableClosers(content) {
     return applyInserts(content, edits).value;
 }
 
+;// ./lib/utils/mdxish/mdxish-variables.ts
+
+
+// The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
+// substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
+// which either evaluated already or is meant to stay literal.
+const MDX_VARIABLE_REGEX = new RegExp(`(?<!\\$)${variable_dist.MDX_VARIABLE_REGEXP}`, 'gu');
+// A whole attribute expression that is one `user.*` reference, e.g. the `user.name` in `title={user.name}`.
+const BARE_VARIABLE_REGEX = new RegExp(`^${variable_dist.MDX_VARIABLE_REGEXP}$`, 'u');
+// Bracket notation names the same variable as dot notation, so normalize it before substituting.
+// Escaped and `$`-prefixed forms are left alone so a reference that stays literal keeps its source.
+// A closing escape needs no lookahead: requiring a literal `]}` already rules out `]\}`.
+const BRACKET_NOTATION_REGEX = /(?<![$\\])\{user\[['"](\w+)['"]\]\}/gu;
+/**
+ * Resolve `{user.*}` in a JSX attribute value against the same `user` binding the rmdx engine gets,
+ * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
+ *
+ * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
+ * an MDX surface, and `{user.*}` is the syntax authors use there.
+ */
+function resolveAttributeVariables(value, user) {
+    if (!value.includes('{user'))
+        return value;
+    return value
+        .replace(BRACKET_NOTATION_REGEX, '{user.$1}')
+        .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
+        if (escapePrefix || escapeSuffix)
+            return source;
+        return stringifyVariableValue(user[name]);
+    });
+}
+/** Whether an attribute expression's source is a bare `user.*` reference, left for render-time substitution. */
+const isBareVariableReference = (source) => BARE_VARIABLE_REGEX.test(`{${source.trim()}}`.replace(BRACKET_NOTATION_REGEX, '{user.$1}'));
+
 ;// ./processor/transform/mdxish/resolve-deferred-attribute-expression-props.ts
 
 
 
 
+
+
+
 /**
  * Resolve attribute expressions that `mdxJsxElementHandler` deferred.
  *
  * The handler stashed each attribute expression's source in `node.data.deferredExpressions`
  * (keyed by prop name) instead of evaluating eagerly, because an eager result can be a React
  * element or function that rehypeRaw's `structuredClone` passthrough rejects. Now that we're
- * past the clone, evaluate each source with a scope of `{ React, ...mdxishScope }` and write
+ * past the clone, evaluate each source with a scope of `{ user, React, ...mdxishScope }` and write
  * the real value into `properties` (e.g. an array of objects whose fields are React elements).
  *
  * Must run after `rehypeRaw` (past the clone) but before `normalizeMdxJsxNodes` rewrites these
  * `mdx-jsx` nodes into plain elements. Skipped in safeMode, which keeps expressions literal.
  */
-const resolveDeferredAttributeExpressionProps = () => (tree, file) => {
+const resolveDeferredAttributeExpressionProps = ({ variables } = {}) => (tree, file) => {
     const scope = { ...file.data.mdxishScope, React: (external_react_default()) };
+    // `user` only when variables were supplied, as in `evaluateExpressions`.
+    const userScope = variables ? { user: user(variables), ...scope } : scope;
     visit(tree, 'mdx-jsx', (node) => {
         const deferredExpressions = node.data?.deferredExpressions;
         if (!deferredExpressions)
             return;
         const properties = node.properties;
         Object.entries(deferredExpressions).forEach(([name, source]) => {
+            // Raw markup never gets `user`: a reader's values reaching `dangerouslySetInnerHTML` is an injection
+            // vector. A bare `{user.x}` keeps render-time substitution, which stringifies structured values.
+            const canReadUser = !RAW_HTML_PROP_NAMES.has(name) && !isBareVariableReference(source);
             try {
-                const result = evalExpression(source, scope);
+                const result = evalExpression(source, canReadUser ? userScope : scope);
                 // hast/HTML `style` is a plain CSS string; a `style={{...}}` expression evaluates to
                 // a JS object, which must be serialized or it renders as the literal "[object Object]".
                 properties[name] = name === 'style' && style_object_to_css_isPlainObject(result) ? styleObjectToCssText(result) : result;
@@ -128714,7 +128758,7 @@ function mdxish(mdContent, opts = {}) {
         .use(preserveBooleanProperties) // RehypeRaw converts boolean properties to empty strings
         .use(rehypeRaw, { passThrough: ['html-block', 'mdx-jsx'] }) // MDX JSX nodes bypass parse5's string-only HTML round-trip
         .use(restoreBooleanProperties)
-        .use(safeMode ? undefined : resolve_deferred_attribute_expression_props) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
+        .use(safeMode ? undefined : resolve_deferred_attribute_expression_props, { variables }) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
         .use(normalize_mdx_jsx_nodes) // Rewrite `mdx-jsx` back to standard `element` nodes for downstream plugins
         .use(sanitize ? rehypeStripTags : undefined) // Strip STRIPPED_TAG_NAMES elements; this pipeline has no sanitization step
         .use(rehypeFlattenTableCellParagraphs) // Remove <p> wrappers inside table cells to prevent margin issues
@@ -128920,36 +128964,6 @@ const makeUseMDXComponents = (more = {}) => {
 };
 /* harmony default export */ const makeUseMdxComponents = (makeUseMDXComponents);
 
-;// ./lib/utils/mdxish/mdxish-variables.ts
-
-
-// The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
-// substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
-// which either evaluated already or is meant to stay literal.
-const MDX_VARIABLE_REGEX = new RegExp(`(?<!\\$)${variable_dist.MDX_VARIABLE_REGEXP}`, 'gu');
-// Bracket notation names the same variable as dot notation, so normalize it before substituting.
-// Escaped and `$`-prefixed forms are left alone so a reference that stays literal keeps its source.
-// A closing escape needs no lookahead: requiring a literal `]}` already rules out `]\}`.
-const BRACKET_NOTATION_REGEX = /(?<![$\\])\{user\[['"](\w+)['"]\]\}/gu;
-/**
- * Resolve `{user.*}` in a JSX attribute value against the same `user` binding the rmdx engine gets,
- * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
- *
- * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
- * an MDX surface, and `{user.*}` is the syntax authors use there.
- */
-function resolveAttributeVariables(value, user) {
-    if (!value.includes('{user'))
-        return value;
-    return value
-        .replace(BRACKET_NOTATION_REGEX, '{user.$1}')
-        .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
-        if (escapePrefix || escapeSuffix)
-            return source;
-        return stringifyVariableValue(user[name]);
-    });
-}
-
 ;// ./lib/utils/mdxish/mdxish-render-utils.tsx
 
 
@@ -128960,6 +128974,7 @@ function resolveAttributeVariables(value, user) {
 
 
 
+
 /** Flatten CustomComponents into a component map for rehype-react */
 function exportComponentsForRehype(components) {
     const exported = Object.entries(components).reduce((memo, [tag, mod]) => {
@@ -128992,8 +129007,6 @@ function exportComponentsForRehype(components) {
  * deliberately leaves mermaid alone; resolving it again here would override that.
  */
 const CODE_TAG_NAMES = new Set(['code']);
-/** Raw markup injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed — never interpolate. */
-const RAW_HTML_PROP_NAMES = new Set(['html']);
 /**
  * Resolve `{user.*}` in string-valued props. Body text is handled by the `Variable` component, but
  * attributes are plain strings, so they are substituted here — at render time, so that a