@readme/markdown 15.9.2 → 15.9.4

package/dist/lib/constants.d.ts

@@ -56,3 +56,5 @@ export declare const TOKENIZER_MDX_COMPONENT_EXCLUDED_TAGS: Set<string>;
  * run after rehype (where hast `tagName` is normalized to lowercase).
  */
 export declare const INLINE_COMPONENT_TAGS_LOWER: Set<string>;
+/** Raw markup props injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed; never interpolate reader values. */
+export declare const RAW_HTML_PROP_NAMES: Set<string>;

package/dist/lib/mdast-util/mdx-expression/index.d.ts

@@ -0,0 +1,3 @@
+import type { Extension as FromMarkdownExtension } from 'mdast-util-from-markdown';
+/** Upstream `mdxExpressionFromMarkdown`, overriding only the text-expression exit to keep `{...}` source in image alt. */
+export declare function mdxishExpressionFromMarkdown(): FromMarkdownExtension;

package/dist/lib/micromark/mdxish-extensions.d.ts

@@ -1,6 +1,5 @@
 import type { Extension as FromMarkdownExtension } from 'mdast-util-from-markdown';
 import type { Extension } from 'micromark-util-types';
-import { mdxExpressionFromMarkdown } from 'mdast-util-mdx-expression';
 import { mdxjsEsmFromMarkdown } from 'mdast-util-mdxjs-esm';
 import { emptyTaskListItemFromMarkdown } from '../mdast-util/empty-task-list-item';
 import { gemojiFromMarkdown } from '../mdast-util/gemoji';
@@ -9,6 +8,7 @@ import { jsxTableFromMarkdown } from '../mdast-util/jsx-table';
 import { legacyVariableFromMarkdown } from '../mdast-util/legacy-variable';
 import { magicBlockFromMarkdown } from '../mdast-util/magic-block';
 import { mdxComponentFromMarkdown } from '../mdast-util/mdx-component';
+import { mdxishExpressionFromMarkdown } from '../mdast-util/mdx-expression';
 import { gemoji } from './gemoji';
 import { htmlBlockComponent } from './html-block-component';
 import { jsxComment } from './jsx-comment';
@@ -50,12 +50,12 @@ declare const REGISTRY: {
     };
     mdxExpressionLenient: {
         syntax: typeof mdxExpressionLenient;
-        fromMarkdown: typeof mdxExpressionFromMarkdown;
+        fromMarkdown: typeof mdxishExpressionFromMarkdown;
         expression: true;
     };
     mdxExpression: {
         syntax: () => Extension;
-        fromMarkdown: typeof mdxExpressionFromMarkdown;
+        fromMarkdown: typeof mdxishExpressionFromMarkdown;
         expression: true;
     };
     mdxComponent: {

package/dist/lib/utils/mdxish/mdxish-variables.d.ts

@@ -3,6 +3,9 @@
  * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
  *
  * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
- * an MDX surface, and `{user.*}` is the syntax authors use there.
+ * an MDX surface, and `{user.*}` is the syntax authors use there. Image alt is the exception, resolved
+ * in the same pass so a substituted value is never rescanned (RM-10865).
  */
-export declare function resolveAttributeVariables(value: string, user: Record<string, unknown>): string;
+export declare function resolveAttributeVariables(value: string, user: Record<string, unknown>, isImageAlt?: boolean): string;
+/** Whether an attribute expression's source is a bare `user.*` reference, left for render-time substitution. */
+export declare const isBareVariableReference: (source: string) => boolean;

package/dist/main.js

@@ -11423,7 +11423,7 @@ module.exports = function () {
 
 /***/ },
 
-/***/ 8846
+/***/ 714
 (module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -13191,6 +13191,8 @@ const TOKENIZER_MDX_COMPONENT_EXCLUDED_TAGS = new Set([
  * run after rehype (where hast `tagName` is normalized to lowercase).
  */
 const INLINE_COMPONENT_TAGS_LOWER = new Set([...INLINE_COMPONENT_TAGS].map(t => t.toLowerCase()));
+/** Raw markup props injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed; never interpolate reader values. */
+const RAW_HTML_PROP_NAMES = new Set(['html']);
 
 ;// ./node_modules/github-slugger/regex.js
 // This module is generated by `script/`.
@@ -73069,6 +73071,26 @@ const mdxToHast = () => tree => {
 };
 /* harmony default export */ const mdx_to_hast = (mdxToHast);
 
+;// ./lib/mdast-util/mdx-expression/index.ts
+
+const upstream = mdxExpressionFromMarkdown();
+/**
+ * An image's alt is its label flattened to text, which drops an expression's braces. Keep the
+ * `{...}` source there so `{user.*}` still resolves in alt at render time (RM-10865).
+ */
+function exitTextExpression(token) {
+    upstream.exit.mdxTextExpression.call(this, token);
+    if (!this.stack.some(node => node.type === 'image'))
+        return;
+    const { children } = this.stack[this.stack.length - 1];
+    const { position } = children[children.length - 1];
+    children[children.length - 1] = { type: 'text', value: this.sliceSerialize(token), position };
+}
+/** Upstream `mdxExpressionFromMarkdown`, overriding only the text-expression exit to keep `{...}` source in image alt. */
+function mdxishExpressionFromMarkdown() {
+    return { ...upstream, exit: { ...upstream.exit, mdxTextExpression: exitTextExpression } };
+}
+
 ;// ./lib/mdast-util/empty-task-list-item/index.ts
 /**
  * Normalizes list items that are written as only `[ ]` or `[x]` into GFM task
@@ -73301,6 +73323,16 @@ function exitlegacyVariableValue(token) {
 function exitlegacyVariable(token) {
     const ctx = legacy_variable_contextMap.get(token);
     const serialized = this.sliceSerialize(token);
+    // An escaped `\<<name>>` (or `\<<name\>>`) is literal text, as in the legacy parser.
+    if (serialized.startsWith('\\')) {
+        const literal = serialized.slice(1).replace('\\>>', '>>');
+        // An image's alt is flattened to a string, so keep the escape for render-time resolution to honor.
+        const inImageAlt = this.stack.some(node => node.type === 'image');
+        this.enter({ type: 'text', value: inImageAlt ? `\\${literal}` : literal }, token);
+        this.exit(token);
+        legacy_variable_contextMap.delete(token);
+        return;
+    }
     const variableName = serialized.startsWith('<<') && serialized.endsWith('>>')
         ? serialized.slice(2, -2)
         : ctx?.value ?? '';
@@ -74894,9 +74926,16 @@ const legacyVariableConstruct = {
 function syntax_tokenize(effects, ok, nok) {
     let hasValue = false;
     const start = (code) => {
+        effects.enter('legacyVariable');
+        // Claim `\<<name>>` before CommonMark's character escape drops the backslash, as the legacy parser did.
+        if (code !== codes.backslash)
+            return open(code);
+        effects.consume(code); // \
+        return open;
+    };
+    const open = (code) => {
         if (code !== codes.lessThan)
             return nok(code);
-        effects.enter('legacyVariable');
         effects.enter('legacyVariableMarkerStart');
         effects.consume(code); // <
         return open2;
@@ -74936,7 +74975,7 @@ function syntax_tokenize(effects, ok, nok) {
 }
 function legacyVariable() {
     return {
-        text: { [codes.lessThan]: legacyVariableConstruct },
+        text: { [codes.backslash]: legacyVariableConstruct, [codes.lessThan]: legacyVariableConstruct },
     };
 }
 
@@ -77260,12 +77299,12 @@ const REGISTRY = {
     magicBlock: { syntax: magicBlock, fromMarkdown: magicBlockFromMarkdown },
     // Two `{` tokenizers, never registered together: the document parser takes text
     // only, the component-body re-parser needs flow too for multi-line expressions.
-    mdxExpressionLenient: { syntax: mdxExpressionLenient, fromMarkdown: mdxExpressionFromMarkdown, expression: true },
+    mdxExpressionLenient: { syntax: mdxExpressionLenient, fromMarkdown: mdxishExpressionFromMarkdown, expression: true },
     // `allowEmpty` is the package default; passed explicitly because `mdx-jsx`
     // registers the same tokenizer with it off for attribute expressions.
     mdxExpression: {
         syntax: () => mdxExpression({ allowEmpty: true }),
-        fromMarkdown: mdxExpressionFromMarkdown,
+        fromMarkdown: mdxishExpressionFromMarkdown,
         expression: true,
     },
     mdxComponent: { syntax: mdxComponent, fromMarkdown: mdxComponentFromMarkdown },
@@ -80865,6 +80904,7 @@ const splitHtmlWithNestedTables = (node, source) => {
 
 
 
+
 
 
 const isTableCell = (node) => isMDXElement(node) && ['th', 'td'].includes(node.name);
@@ -80885,9 +80925,13 @@ const buildTableNodeProcessor = (withMdx) => {
     const { micromarkExtensions, fromMarkdownExtensions } = mdxishExtensions(FEATURES.tableCell);
     // `mdxjs` goes first (= lowest priority): its `mdxJsx` also claims `text` + `<`,
     // and `legacyVariable` has to keep winning that race so `<<var>>` still parses.
+    // `mdxishExpressionFromMarkdown` follows `mdxFromMarkdown` to override its expression exit.
     return unified()
         .data('micromarkExtensions', [...(withMdx ? [mdxjs()] : []), ...micromarkExtensions])
-        .data('fromMarkdownExtensions', [...(withMdx ? [mdxFromMarkdown()] : []), ...fromMarkdownExtensions])
+        .data('fromMarkdownExtensions', [
+        ...(withMdx ? [mdxFromMarkdown(), mdxishExpressionFromMarkdown()] : []),
+        ...fromMarkdownExtensions,
+    ])
         .use(remarkParse)
         .use(normalize_malformed_md_syntax)
         .use([[callouts, { isMdxish: true }], code_tabs])
@@ -107775,33 +107819,81 @@ function repairMistakenTableClosers(content) {
     return applyInserts(content, edits).value;
 }
 
+;// ./lib/utils/mdxish/mdxish-variables.ts
+
+
+// The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
+// substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
+// which either evaluated already or is meant to stay literal.
+const MDX_VARIABLE_REGEX = new RegExp(`(?<!\\$)${variable_.MDX_VARIABLE_REGEXP}`, 'gu');
+// A whole attribute expression that is one `user.*` reference, e.g. the `user.name` in `title={user.name}`.
+const BARE_VARIABLE_REGEX = new RegExp(`^${variable_.MDX_VARIABLE_REGEXP}$`, 'u');
+// Bracket notation names the same variable as dot notation, so normalize it before substituting.
+// Escaped and `$`-prefixed forms are left alone so a reference that stays literal keeps its source.
+// A closing escape needs no lookahead: requiring a literal `]}` already rules out `]\}`.
+const BRACKET_NOTATION_REGEX = /(?<![$\\])\{user\[['"](\w+)['"]\]\}/gu;
+const ALT_VARIABLE_REGEX = new RegExp(`${MDX_VARIABLE_REGEX.source}|${variable_.VARIABLE_REGEXP}`, 'gu');
+/**
+ * Resolve `{user.*}` in a JSX attribute value against the same `user` binding the rmdx engine gets,
+ * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
+ *
+ * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
+ * an MDX surface, and `{user.*}` is the syntax authors use there. Image alt is the exception, resolved
+ * in the same pass so a substituted value is never rescanned (RM-10865).
+ */
+function resolveAttributeVariables(value, user, isImageAlt = false) {
+    if (!isImageAlt && !value.includes('{user'))
+        return value;
+    return value
+        .replace(BRACKET_NOTATION_REGEX, '{user.$1}')
+        .replace(isImageAlt ? ALT_VARIABLE_REGEX : MDX_VARIABLE_REGEX, (source, _prefix, name, _suffix, legacyName) => {
+        // Variable names can't contain a backslash, so one marks an escaped reference.
+        if (source.includes('\\'))
+            return isImageAlt ? source.replaceAll('\\', '') : source;
+        const key = (name ?? legacyName).trim();
+        if (key.startsWith('glossary:'))
+            return key.slice('glossary:'.length).trim();
+        return stringifyVariableValue(user[key]);
+    });
+}
+/** Whether an attribute expression's source is a bare `user.*` reference, left for render-time substitution. */
+const isBareVariableReference = (source) => BARE_VARIABLE_REGEX.test(`{${source.trim()}}`.replace(BRACKET_NOTATION_REGEX, '{user.$1}'));
+
 ;// ./processor/transform/mdxish/resolve-deferred-attribute-expression-props.ts
 
 
 
 
+
+
+
 /**
  * Resolve attribute expressions that `mdxJsxElementHandler` deferred.
  *
  * The handler stashed each attribute expression's source in `node.data.deferredExpressions`
  * (keyed by prop name) instead of evaluating eagerly, because an eager result can be a React
  * element or function that rehypeRaw's `structuredClone` passthrough rejects. Now that we're
- * past the clone, evaluate each source with a scope of `{ React, ...mdxishScope }` and write
+ * past the clone, evaluate each source with a scope of `{ user, React, ...mdxishScope }` and write
  * the real value into `properties` (e.g. an array of objects whose fields are React elements).
  *
  * Must run after `rehypeRaw` (past the clone) but before `normalizeMdxJsxNodes` rewrites these
  * `mdx-jsx` nodes into plain elements. Skipped in safeMode, which keeps expressions literal.
  */
-const resolveDeferredAttributeExpressionProps = () => (tree, file) => {
+const resolveDeferredAttributeExpressionProps = ({ variables } = {}) => (tree, file) => {
     const scope = { ...file.data.mdxishScope, React: (external_amd_react_commonjs_react_commonjs2_react_root_React_umd_react_default()) };
+    // `user` only when variables were supplied, as in `evaluateExpressions`.
+    const userScope = variables ? { user: user(variables), ...scope } : scope;
     visit(tree, 'mdx-jsx', (node) => {
         const deferredExpressions = node.data?.deferredExpressions;
         if (!deferredExpressions)
             return;
         const properties = node.properties;
         Object.entries(deferredExpressions).forEach(([name, source]) => {
+            // Raw markup never gets `user`: a reader's values reaching `dangerouslySetInnerHTML` is an injection
+            // vector. A bare `{user.x}` keeps render-time substitution, which stringifies structured values.
+            const canReadUser = !RAW_HTML_PROP_NAMES.has(name) && !isBareVariableReference(source);
             try {
-                const result = evalExpression(source, scope);
+                const result = evalExpression(source, canReadUser ? userScope : scope);
                 // hast/HTML `style` is a plain CSS string; a `style={{...}}` expression evaluates to
                 // a JS object, which must be serialized or it renders as the literal "[object Object]".
                 properties[name] = name === 'style' && style_object_to_css_isPlainObject(result) ? styleObjectToCssText(result) : result;
@@ -108465,7 +108557,7 @@ function mdxish(mdContent, opts = {}) {
         .use(preserveBooleanProperties) // RehypeRaw converts boolean properties to empty strings
         .use(rehypeRaw, { passThrough: ['html-block', 'mdx-jsx'] }) // MDX JSX nodes bypass parse5's string-only HTML round-trip
         .use(restoreBooleanProperties)
-        .use(safeMode ? undefined : resolve_deferred_attribute_expression_props) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
+        .use(safeMode ? undefined : resolve_deferred_attribute_expression_props, { variables }) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
         .use(normalize_mdx_jsx_nodes) // Rewrite `mdx-jsx` back to standard `element` nodes for downstream plugins
         .use(sanitize ? rehypeStripTags : undefined) // Strip STRIPPED_TAG_NAMES elements; this pipeline has no sanitization step
         .use(rehypeFlattenTableCellParagraphs) // Remove <p> wrappers inside table cells to prevent margin issues
@@ -108671,36 +108763,6 @@ const makeUseMDXComponents = (more = {}) => {
 };
 /* harmony default export */ const makeUseMdxComponents = (makeUseMDXComponents);
 
-;// ./lib/utils/mdxish/mdxish-variables.ts
-
-
-// The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
-// substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
-// which either evaluated already or is meant to stay literal.
-const MDX_VARIABLE_REGEX = new RegExp(`(?<!\\$)${variable_.MDX_VARIABLE_REGEXP}`, 'gu');
-// Bracket notation names the same variable as dot notation, so normalize it before substituting.
-// Escaped and `$`-prefixed forms are left alone so a reference that stays literal keeps its source.
-// A closing escape needs no lookahead: requiring a literal `]}` already rules out `]\}`.
-const BRACKET_NOTATION_REGEX = /(?<![$\\])\{user\[['"](\w+)['"]\]\}/gu;
-/**
- * Resolve `{user.*}` in a JSX attribute value against the same `user` binding the rmdx engine gets,
- * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
- *
- * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
- * an MDX surface, and `{user.*}` is the syntax authors use there.
- */
-function resolveAttributeVariables(value, user) {
-    if (!value.includes('{user'))
-        return value;
-    return value
-        .replace(BRACKET_NOTATION_REGEX, '{user.$1}')
-        .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
-        if (escapePrefix || escapeSuffix)
-            return source;
-        return stringifyVariableValue(user[name]);
-    });
-}
-
 ;// ./lib/utils/mdxish/mdxish-render-utils.tsx
 
 
@@ -108711,6 +108773,7 @@ function resolveAttributeVariables(value, user) {
 
 
 
+
 /** Flatten CustomComponents into a component map for rehype-react */
 function exportComponentsForRehype(components) {
     const exported = Object.entries(components).reduce((memo, [tag, mod]) => {
@@ -108743,10 +108806,10 @@ function exportComponentsForRehype(components) {
  * deliberately leaves mermaid alone; resolving it again here would override that.
  */
 const CODE_TAG_NAMES = new Set(['code']);
-/** Raw markup injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed — never interpolate. */
-const RAW_HTML_PROP_NAMES = new Set(['html']);
+const isImageAlt = (tagName, key) => tagName === 'img' && key === 'alt';
 /**
- * Resolve `{user.*}` in string-valued props. Body text is handled by the `Variable` component, but
+ * Resolve `{user.*}` in string-valued props, plus legacy `<<...>>` in img alt, where markdown flattens
+ * body variables to text (RM-10865). Body text is handled by the `Variable` component, but
  * attributes are plain strings, so they are substituted here — at render time, so that a
  * server-parsed (user-agnostic) tree resolves against the current reader's variables.
  */
@@ -108756,7 +108819,7 @@ function resolveVariablesInProps(props, user, tagName) {
         const isDocumentContent = RAW_HTML_PROP_NAMES.has(key) || (isCodeTag && key === 'value');
         if (typeof value !== 'string' || isDocumentContent)
             return [key, value];
-        return [key, resolveAttributeVariables(value, user)];
+        return [key, resolveAttributeVariables(value, user, isImageAlt(tagName, key))];
     });
     return Object.fromEntries(resolvedEntries);
 }
@@ -109446,7 +109509,7 @@ module.exports = /*#__PURE__*/JSON.parse('{"*":["about","acceptCharset","accessK
 /******/ 	// startup
 /******/ 	// Load entry module and return exports
 /******/ 	// This entry module used 'module' so it can't be inlined
-/******/ 	let __webpack_exports__ = __webpack_require__(8846);
+/******/ 	let __webpack_exports__ = __webpack_require__(714);
 /******/ 	
 /******/ 	return __webpack_exports__;
 /******/ })()

package/dist/main.node.js

@@ -19111,7 +19111,7 @@ module.exports = function () {
 
 /***/ },
 
-/***/ 6831
+/***/ 3975
 (module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -25789,6 +25789,8 @@ const TOKENIZER_MDX_COMPONENT_EXCLUDED_TAGS = new Set([
  * run after rehype (where hast `tagName` is normalized to lowercase).
  */
 const INLINE_COMPONENT_TAGS_LOWER = new Set([...INLINE_COMPONENT_TAGS].map(t => t.toLowerCase()));
+/** Raw markup props injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed; never interpolate reader values. */
+const RAW_HTML_PROP_NAMES = new Set(['html']);
 
 ;// ./node_modules/github-slugger/regex.js
 // This module is generated by `script/`.
@@ -93318,6 +93320,26 @@ const mdxToHast = () => tree => {
 };
 /* harmony default export */ const mdx_to_hast = (mdxToHast);
 
+;// ./lib/mdast-util/mdx-expression/index.ts
+
+const upstream = mdxExpressionFromMarkdown();
+/**
+ * An image's alt is its label flattened to text, which drops an expression's braces. Keep the
+ * `{...}` source there so `{user.*}` still resolves in alt at render time (RM-10865).
+ */
+function exitTextExpression(token) {
+    upstream.exit.mdxTextExpression.call(this, token);
+    if (!this.stack.some(node => node.type === 'image'))
+        return;
+    const { children } = this.stack[this.stack.length - 1];
+    const { position } = children[children.length - 1];
+    children[children.length - 1] = { type: 'text', value: this.sliceSerialize(token), position };
+}
+/** Upstream `mdxExpressionFromMarkdown`, overriding only the text-expression exit to keep `{...}` source in image alt. */
+function mdxishExpressionFromMarkdown() {
+    return { ...upstream, exit: { ...upstream.exit, mdxTextExpression: exitTextExpression } };
+}
+
 ;// ./lib/mdast-util/empty-task-list-item/index.ts
 /**
  * Normalizes list items that are written as only `[ ]` or `[x]` into GFM task
@@ -93550,6 +93572,16 @@ function exitlegacyVariableValue(token) {
 function exitlegacyVariable(token) {
     const ctx = legacy_variable_contextMap.get(token);
     const serialized = this.sliceSerialize(token);
+    // An escaped `\<<name>>` (or `\<<name\>>`) is literal text, as in the legacy parser.
+    if (serialized.startsWith('\\')) {
+        const literal = serialized.slice(1).replace('\\>>', '>>');
+        // An image's alt is flattened to a string, so keep the escape for render-time resolution to honor.
+        const inImageAlt = this.stack.some(node => node.type === 'image');
+        this.enter({ type: 'text', value: inImageAlt ? `\\${literal}` : literal }, token);
+        this.exit(token);
+        legacy_variable_contextMap.delete(token);
+        return;
+    }
     const variableName = serialized.startsWith('<<') && serialized.endsWith('>>')
         ? serialized.slice(2, -2)
         : ctx?.value ?? '';
@@ -95143,9 +95175,16 @@ const legacyVariableConstruct = {
 function syntax_tokenize(effects, ok, nok) {
     let hasValue = false;
     const start = (code) => {
+        effects.enter('legacyVariable');
+        // Claim `\<<name>>` before CommonMark's character escape drops the backslash, as the legacy parser did.
+        if (code !== codes.backslash)
+            return open(code);
+        effects.consume(code); // \
+        return open;
+    };
+    const open = (code) => {
         if (code !== codes.lessThan)
             return nok(code);
-        effects.enter('legacyVariable');
         effects.enter('legacyVariableMarkerStart');
         effects.consume(code); // <
         return open2;
@@ -95185,7 +95224,7 @@ function syntax_tokenize(effects, ok, nok) {
 }
 function legacyVariable() {
     return {
-        text: { [codes.lessThan]: legacyVariableConstruct },
+        text: { [codes.backslash]: legacyVariableConstruct, [codes.lessThan]: legacyVariableConstruct },
     };
 }
 
@@ -97509,12 +97548,12 @@ const REGISTRY = {
     magicBlock: { syntax: magicBlock, fromMarkdown: magicBlockFromMarkdown },
     // Two `{` tokenizers, never registered together: the document parser takes text
     // only, the component-body re-parser needs flow too for multi-line expressions.
-    mdxExpressionLenient: { syntax: mdxExpressionLenient, fromMarkdown: mdxExpressionFromMarkdown, expression: true },
+    mdxExpressionLenient: { syntax: mdxExpressionLenient, fromMarkdown: mdxishExpressionFromMarkdown, expression: true },
     // `allowEmpty` is the package default; passed explicitly because `mdx-jsx`
     // registers the same tokenizer with it off for attribute expressions.
     mdxExpression: {
         syntax: () => mdxExpression({ allowEmpty: true }),
-        fromMarkdown: mdxExpressionFromMarkdown,
+        fromMarkdown: mdxishExpressionFromMarkdown,
         expression: true,
     },
     mdxComponent: { syntax: mdxComponent, fromMarkdown: mdxComponentFromMarkdown },
@@ -101114,6 +101153,7 @@ const splitHtmlWithNestedTables = (node, source) => {
 
 
 
+
 
 
 const isTableCell = (node) => isMDXElement(node) && ['th', 'td'].includes(node.name);
@@ -101134,9 +101174,13 @@ const buildTableNodeProcessor = (withMdx) => {
     const { micromarkExtensions, fromMarkdownExtensions } = mdxishExtensions(FEATURES.tableCell);
     // `mdxjs` goes first (= lowest priority): its `mdxJsx` also claims `text` + `<`,
     // and `legacyVariable` has to keep winning that race so `<<var>>` still parses.
+    // `mdxishExpressionFromMarkdown` follows `mdxFromMarkdown` to override its expression exit.
     return unified()
         .data('micromarkExtensions', [...(withMdx ? [mdxjs()] : []), ...micromarkExtensions])
-        .data('fromMarkdownExtensions', [...(withMdx ? [mdxFromMarkdown()] : []), ...fromMarkdownExtensions])
+        .data('fromMarkdownExtensions', [
+        ...(withMdx ? [mdxFromMarkdown(), mdxishExpressionFromMarkdown()] : []),
+        ...fromMarkdownExtensions,
+    ])
         .use(remarkParse)
         .use(normalize_malformed_md_syntax)
         .use([[callouts, { isMdxish: true }], code_tabs])
@@ -128024,33 +128068,81 @@ function repairMistakenTableClosers(content) {
     return applyInserts(content, edits).value;
 }
 
+;// ./lib/utils/mdxish/mdxish-variables.ts
+
+
+// The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
+// substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
+// which either evaluated already or is meant to stay literal.
+const MDX_VARIABLE_REGEX = new RegExp(`(?<!\\$)${variable_dist.MDX_VARIABLE_REGEXP}`, 'gu');
+// A whole attribute expression that is one `user.*` reference, e.g. the `user.name` in `title={user.name}`.
+const BARE_VARIABLE_REGEX = new RegExp(`^${variable_dist.MDX_VARIABLE_REGEXP}$`, 'u');
+// Bracket notation names the same variable as dot notation, so normalize it before substituting.
+// Escaped and `$`-prefixed forms are left alone so a reference that stays literal keeps its source.
+// A closing escape needs no lookahead: requiring a literal `]}` already rules out `]\}`.
+const BRACKET_NOTATION_REGEX = /(?<![$\\])\{user\[['"](\w+)['"]\]\}/gu;
+const ALT_VARIABLE_REGEX = new RegExp(`${MDX_VARIABLE_REGEX.source}|${variable_dist.VARIABLE_REGEXP}`, 'gu');
+/**
+ * Resolve `{user.*}` in a JSX attribute value against the same `user` binding the rmdx engine gets,
+ * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
+ *
+ * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
+ * an MDX surface, and `{user.*}` is the syntax authors use there. Image alt is the exception, resolved
+ * in the same pass so a substituted value is never rescanned (RM-10865).
+ */
+function resolveAttributeVariables(value, user, isImageAlt = false) {
+    if (!isImageAlt && !value.includes('{user'))
+        return value;
+    return value
+        .replace(BRACKET_NOTATION_REGEX, '{user.$1}')
+        .replace(isImageAlt ? ALT_VARIABLE_REGEX : MDX_VARIABLE_REGEX, (source, _prefix, name, _suffix, legacyName) => {
+        // Variable names can't contain a backslash, so one marks an escaped reference.
+        if (source.includes('\\'))
+            return isImageAlt ? source.replaceAll('\\', '') : source;
+        const key = (name ?? legacyName).trim();
+        if (key.startsWith('glossary:'))
+            return key.slice('glossary:'.length).trim();
+        return stringifyVariableValue(user[key]);
+    });
+}
+/** Whether an attribute expression's source is a bare `user.*` reference, left for render-time substitution. */
+const isBareVariableReference = (source) => BARE_VARIABLE_REGEX.test(`{${source.trim()}}`.replace(BRACKET_NOTATION_REGEX, '{user.$1}'));
+
 ;// ./processor/transform/mdxish/resolve-deferred-attribute-expression-props.ts
 
 
 
 
+
+
+
 /**
  * Resolve attribute expressions that `mdxJsxElementHandler` deferred.
  *
  * The handler stashed each attribute expression's source in `node.data.deferredExpressions`
  * (keyed by prop name) instead of evaluating eagerly, because an eager result can be a React
  * element or function that rehypeRaw's `structuredClone` passthrough rejects. Now that we're
- * past the clone, evaluate each source with a scope of `{ React, ...mdxishScope }` and write
+ * past the clone, evaluate each source with a scope of `{ user, React, ...mdxishScope }` and write
  * the real value into `properties` (e.g. an array of objects whose fields are React elements).
  *
  * Must run after `rehypeRaw` (past the clone) but before `normalizeMdxJsxNodes` rewrites these
  * `mdx-jsx` nodes into plain elements. Skipped in safeMode, which keeps expressions literal.
  */
-const resolveDeferredAttributeExpressionProps = () => (tree, file) => {
+const resolveDeferredAttributeExpressionProps = ({ variables } = {}) => (tree, file) => {
     const scope = { ...file.data.mdxishScope, React: (external_react_default()) };
+    // `user` only when variables were supplied, as in `evaluateExpressions`.
+    const userScope = variables ? { user: user(variables), ...scope } : scope;
     visit(tree, 'mdx-jsx', (node) => {
         const deferredExpressions = node.data?.deferredExpressions;
         if (!deferredExpressions)
             return;
         const properties = node.properties;
         Object.entries(deferredExpressions).forEach(([name, source]) => {
+            // Raw markup never gets `user`: a reader's values reaching `dangerouslySetInnerHTML` is an injection
+            // vector. A bare `{user.x}` keeps render-time substitution, which stringifies structured values.
+            const canReadUser = !RAW_HTML_PROP_NAMES.has(name) && !isBareVariableReference(source);
             try {
-                const result = evalExpression(source, scope);
+                const result = evalExpression(source, canReadUser ? userScope : scope);
                 // hast/HTML `style` is a plain CSS string; a `style={{...}}` expression evaluates to
                 // a JS object, which must be serialized or it renders as the literal "[object Object]".
                 properties[name] = name === 'style' && style_object_to_css_isPlainObject(result) ? styleObjectToCssText(result) : result;
@@ -128714,7 +128806,7 @@ function mdxish(mdContent, opts = {}) {
         .use(preserveBooleanProperties) // RehypeRaw converts boolean properties to empty strings
         .use(rehypeRaw, { passThrough: ['html-block', 'mdx-jsx'] }) // MDX JSX nodes bypass parse5's string-only HTML round-trip
         .use(restoreBooleanProperties)
-        .use(safeMode ? undefined : resolve_deferred_attribute_expression_props) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
+        .use(safeMode ? undefined : resolve_deferred_attribute_expression_props, { variables }) // Evaluate deferred attribute expressions on mdx-jsx nodes (now past rehypeRaw's clone)
         .use(normalize_mdx_jsx_nodes) // Rewrite `mdx-jsx` back to standard `element` nodes for downstream plugins
         .use(sanitize ? rehypeStripTags : undefined) // Strip STRIPPED_TAG_NAMES elements; this pipeline has no sanitization step
         .use(rehypeFlattenTableCellParagraphs) // Remove <p> wrappers inside table cells to prevent margin issues
@@ -128920,36 +129012,6 @@ const makeUseMDXComponents = (more = {}) => {
 };
 /* harmony default export */ const makeUseMdxComponents = (makeUseMDXComponents);
 
-;// ./lib/utils/mdxish/mdxish-variables.ts
-
-
-// The `$` guard skips template-literal interpolation: `${user.name}` embeds `{user.name}`, and
-// substituting it would leave a mangled `` `Hi $Name` `` behind. Those belong to an expression,
-// which either evaluated already or is meant to stay literal.
-const MDX_VARIABLE_REGEX = new RegExp(`(?<!\\$)${variable_dist.MDX_VARIABLE_REGEXP}`, 'gu');
-// Bracket notation names the same variable as dot notation, so normalize it before substituting.
-// Escaped and `$`-prefixed forms are left alone so a reference that stays literal keeps its source.
-// A closing escape needs no lookahead: requiring a literal `]}` already rules out `]\}`.
-const BRACKET_NOTATION_REGEX = /(?<![$\\])\{user\[['"](\w+)['"]\]\}/gu;
-/**
- * Resolve `{user.*}` in a JSX attribute value against the same `user` binding the rmdx engine gets,
- * so both engines agree. Body text differs on empty values: `Variable` falls back to the default.
- *
- * Legacy `<<...>>` is valid inside a quoted attribute but deliberately left literal — attributes are
- * an MDX surface, and `{user.*}` is the syntax authors use there.
- */
-function resolveAttributeVariables(value, user) {
-    if (!value.includes('{user'))
-        return value;
-    return value
-        .replace(BRACKET_NOTATION_REGEX, '{user.$1}')
-        .replace(MDX_VARIABLE_REGEX, (source, escapePrefix, name, escapeSuffix) => {
-        if (escapePrefix || escapeSuffix)
-            return source;
-        return stringifyVariableValue(user[name]);
-    });
-}
-
 ;// ./lib/utils/mdxish/mdxish-render-utils.tsx
 
 
@@ -128960,6 +129022,7 @@ function resolveAttributeVariables(value, user) {
 
 
 
+
 /** Flatten CustomComponents into a component map for rehype-react */
 function exportComponentsForRehype(components) {
     const exported = Object.entries(components).reduce((memo, [tag, mod]) => {
@@ -128992,10 +129055,10 @@ function exportComponentsForRehype(components) {
  * deliberately leaves mermaid alone; resolving it again here would override that.
  */
 const CODE_TAG_NAMES = new Set(['code']);
-/** Raw markup injected with `dangerouslySetInnerHTML` by HTMLBlock and Embed — never interpolate. */
-const RAW_HTML_PROP_NAMES = new Set(['html']);
+const isImageAlt = (tagName, key) => tagName === 'img' && key === 'alt';
 /**
- * Resolve `{user.*}` in string-valued props. Body text is handled by the `Variable` component, but
+ * Resolve `{user.*}` in string-valued props, plus legacy `<<...>>` in img alt, where markdown flattens
+ * body variables to text (RM-10865). Body text is handled by the `Variable` component, but
  * attributes are plain strings, so they are substituted here — at render time, so that a
  * server-parsed (user-agnostic) tree resolves against the current reader's variables.
  */
@@ -129005,7 +129068,7 @@ function resolveVariablesInProps(props, user, tagName) {
         const isDocumentContent = RAW_HTML_PROP_NAMES.has(key) || (isCodeTag && key === 'value');
         if (typeof value !== 'string' || isDocumentContent)
             return [key, value];
-        return [key, resolveAttributeVariables(value, user)];
+        return [key, resolveAttributeVariables(value, user, isImageAlt(tagName, key))];
     });
     return Object.fromEntries(resolvedEntries);
 }
@@ -129754,7 +129817,7 @@ module.exports = /*#__PURE__*/JSON.parse('{"*":["about","acceptCharset","accessK
 /******/ 	// startup
 /******/ 	// Load entry module and return exports
 /******/ 	// This entry module used 'module' so it can't be inlined
-/******/ 	let __webpack_exports__ = __webpack_require__(6831);
+/******/ 	let __webpack_exports__ = __webpack_require__(3975);
 /******/ 	module.exports = __webpack_exports__;
 /******/ 	
 /******/ })()