@vibelord/lanes 1.2.0 → 1.3.0

package/payload/lanes/libexec/mdlite.py

@@ -0,0 +1,575 @@
+"""mdlite.py — a Markdown subset rendered to an HTML fragment, standard library only (W10 W2, LNS-103).
+
+The docs cockpit (`lanes-docsd`, W10 W3) renders what agents publish from a lane with it. Agent content is hostile, so
+the scope is chosen for that one use: the output holds only the fixed tags below, every text node and attribute value
+passes `html.escape(s, quote=True)` exactly once, raw HTML in the input is text, and a link or image whose destination
+is not on the allowlist keeps its text and loses its URL. Deterministic: the same text always renders the same bytes.
+
+  render(text) -> str   an HTML fragment (no <html>/<body>), each block on its own line, ending in a newline ('' for
+                        blank input); TooLarge (a ValueError) past MAX_BYTES of UTF-8, TypeError for a non-str
+
+Blocks: ATX headings (# to ######, closing hashes dropped); paragraphs (blank-line separated; soft line breaks join with
+one space); - * + and 1. 1) lists, tight, one nesting level by 2+ spaces (deeper items join that level); fences ``` and
+~~~ with an optional info string — `mermaid` gives <pre class="mermaid">, any other <pre><code class="language-X">
+with X the info's first word lowercased and reduced to [a-z0-9_-] (none: no class), unterminated = code to the end;
+blockquotes (> , nested at most MAX_QUOTE_DEPTH deep, deeper markers are text); pipe tables with a separator row whose
+cell count matches the header (colons accepted, alignment not rendered; | inside a code span or as \\| stays in the
+cell); rules --- *** ___. Not in the subset: setext headings, indented code, HTML blocks, entity decoding (&lt; shows as
+typed), hard line breaks, footnotes, task lists, blocks inside list items.
+
+Inline: `code`, **strong**, *em* / _em_ (CommonMark delimiter runs, without the rule of three), backslash escapes of
+ASCII punctuation, [text](url "title"), <scheme:...> and <user@host> autolinks, ![alt](src "title"). A link's href must
+start with http:// https:// mailto: /lanes-docs/ or # and hold no space, control or DEL character (a space inside
+<...> becomes %20), no backslash, and — checked after the backslash escapes are resolved — no `.` or `..` segment in
+its path, `%2e` spellings in any case included, and on this site no `%2f`/`%5c` in it (a browser resolves dot
+segments before it requests, and a server may decode an encoded slash into one, so a prefix test let
+`/lanes-docs/../ws/x` and `/lanes-docs/%2e%2e/ws/x` reach any path of the site: security review 2026-10-08, F3);
+http(s) links get rel="noopener noreferrer" target="_blank". An image's src is exactly a document's bytes on this site,
+/lanes-docs/d/<id>/raw or /lanes-docs/d/<id>/artifact (<id> docs_store's [a-z0-9]{10,20}), or a base64 raster
+data:image/png|jpeg|gif|webp; anything else renders the alt text. No link inside a link.
+
+python3 libexec/mdlite.py [FILE]   renders FILE (or stdin) to stdout (a manual check; docsd imports render()).
+"""
+import bisect
+import html
+import re
+import sys
+import unicodedata
+
+MAX_BYTES = 1 << 20          # 1 MiB of UTF-8: larger input is refused, not truncated
+MAX_QUOTE_DEPTH = 8          # nested blockquotes; recursion depth of the block parser
+
+
+class TooLarge(ValueError):
+    """The input is longer than MAX_BYTES of UTF-8."""
+
+    def __init__(self, size, limit=MAX_BYTES):
+        super().__init__(f'markdown input is {size} bytes; the limit is {limit}')
+        self.size, self.limit = size, limit
+
+
+_esc = html.escape            # quote=True is its default: & < > " ' all become references, once
+
+
+# ---------------------------------------------------------------------------------------------------------------------
+# Blocks
+
+_FENCE = re.compile(r'( {0,3})(`{3,}|~{3,})[ \t]*(.*)')
+_HEADING = re.compile(r' {0,3}(#{1,6})(?:[ \t]+(.*))?')
+_RULE = re.compile(r' {0,3}([-*_])(?:[ \t]*\1){2,}[ \t]*')
+_QUOTE = re.compile(r' {0,3}> ?')
+_ITEM = re.compile(r'( {0,3})([-*+]|[0-9]{1,9}[.)])(?:[ \t]+(.*)|[ \t]*)')
+_SEPARATOR_CELL = re.compile(r':?-+:?')
+_MARKS = frozenset('`~#-*_>+0123456789')    # the first characters (after up to 3 spaces) a block other than a table
+_CELL_TOKEN = re.compile(r'\\[\s\S]|`+|\|')
+
+
+def _fence(line):
+    """(indent, marker char, marker length, info) when the line opens a fence, else None."""
+    m = _FENCE.fullmatch(line)
+    if not m or (m.group(2)[0] == '`' and '`' in m.group(3)):
+        return None
+    return len(m.group(1)), m.group(2)[0], len(m.group(2)), m.group(3).strip()
+
+
+def _closes(line, char, length):
+    body = line.strip(' \t')
+    return len(line) - len(line.lstrip(' ')) <= 3 and len(body) >= length and body == char * len(body)
+
+
+def _indent(line):
+    """Leading whitespace in columns, a tab counting to the next multiple of 4."""
+    return len(line[:len(line) - len(line.lstrip(' \t'))].expandtabs(4))
+
+
+def _item(line):
+    """(indent, ordered, delimiter, number, text) when the line is a list item, else None."""
+    m = _ITEM.fullmatch(line)
+    if not m:
+        return None
+    marker = m.group(2)
+    ordered = marker[0].isdigit()
+    return len(m.group(1)), ordered, marker[-1], int(marker[:-1]) if ordered else 1, m.group(3) or ''
+
+
+def _separator(line):
+    """The cell count of a table separator row (|-separated cells of dashes, colons at either end), else 0. Split, not
+    one regex: whitespace quantifiers side by side backtrack quadratically on a long run of spaces."""
+    s = line.strip()
+    if '|' not in s or len(line) - len(line.lstrip(' ')) > 3:
+        return 0
+    s = s[1:] if s.startswith('|') else s
+    s = s[:-1] if s.endswith('|') else s
+    cells = s.split('|')
+    return len(cells) if all(_SEPARATOR_CELL.fullmatch(cell.strip(' \t')) for cell in cells) else 0
+
+
+def _table_at(lines, i):
+    """The header cells when lines[i] opens a table (its separator row's cell count matches), else None."""
+    if i + 1 >= len(lines) or '|' not in lines[i]:
+        return None
+    count = _separator(lines[i + 1])
+    header = _cells(lines[i]) if count else None
+    return header if header is not None and len(header) == count else None
+
+
+def _starts_block(lines, i, depth, in_paragraph=False):
+    line = lines[i]
+    if line.lstrip(' ')[:1] not in _MARKS:
+        return '|' in line and _table_at(lines, i) is not None
+    if _fence(line) or _HEADING.fullmatch(line) or _RULE.fullmatch(line):
+        return True
+    if depth < MAX_QUOTE_DEPTH and _QUOTE.match(line):
+        return True
+    item = _item(line)
+    if item and not (in_paragraph and (not item[4].strip() or (item[1] and item[3] != 1))):
+        return True
+    return _table_at(lines, i) is not None
+
+
+def _blocks(lines, depth):
+    out, i, n = [], 0, len(lines)
+    while i < n:
+        line = lines[i]
+        if not line.strip():
+            i += 1
+            continue
+        marked = line.lstrip(' ')[:1] in _MARKS
+        fence = _fence(line) if marked else None
+        if fence:
+            indent, char, length, info = fence
+            body, i = [], i + 1
+            while i < n and not _closes(lines[i], char, length):
+                text = lines[i]
+                body.append(text[min(indent, len(text) - len(text.lstrip(' '))):])
+                i += 1
+            i += 1
+            code = _esc('\n'.join(body)) + '\n' if body else ''
+            word = info.split()[0].lower() if info else ''
+            if word == 'mermaid':
+                out.append(f'<pre class="mermaid">{code}</pre>')
+            else:
+                lang = re.sub(r'[^a-z0-9_-]', '', word)[:32]
+                out.append(f'<pre><code class="language-{lang}">{code}</code></pre>' if lang
+                           else f'<pre><code>{code}</code></pre>')
+            continue
+        m = _HEADING.fullmatch(line) if marked else None
+        if m:
+            text = (m.group(2) or '').strip()
+            bare = text.rstrip('#')
+            if not bare:
+                text = ''
+            elif bare != text and bare[-1] in ' \t':
+                text = bare.rstrip()
+            level = len(m.group(1))
+            out.append(f'<h{level}>{_inline(text)}</h{level}>')
+            i += 1
+            continue
+        if marked and _RULE.fullmatch(line):
+            out.append('<hr>')
+            i += 1
+            continue
+        if marked and depth < MAX_QUOTE_DEPTH and _QUOTE.match(line):
+            inner = []
+            while i < n and _QUOTE.match(lines[i]):
+                inner.append(lines[i][_QUOTE.match(lines[i]).end():])
+                i += 1
+            out.append('<blockquote>\n' + '\n'.join(_blocks(inner, depth + 1)) + '\n</blockquote>')
+            continue
+        if marked and _item(line):
+            html_list, i = _list(lines, i, depth)
+            out.append(html_list)
+            continue
+        header = _table_at(lines, i)
+        if header is not None:
+            rows, i = [], i + 2
+            while i < n and lines[i].strip() and '|' in lines[i]:
+                cells = _cells(lines[i])[:len(header)]
+                rows.append(cells + [''] * (len(header) - len(cells)))
+                i += 1
+            parts = ['<table>', '<thead>', '<tr>' + ''.join(f'<th>{_inline(c)}</th>' for c in header) + '</tr>',
+                     '</thead>']
+            if rows:
+                parts += ['<tbody>'] + ['<tr>' + ''.join(f'<td>{_inline(c)}</td>' for c in row) + '</tr>'
+                                        for row in rows] + ['</tbody>']
+            out.append('\n'.join(parts + ['</table>']))
+            continue
+        para = [line.strip()]
+        i += 1
+        while i < n and lines[i].strip() and not _starts_block(lines, i, depth, in_paragraph=True):
+            para.append(lines[i].strip())
+            i += 1
+        out.append(f'<p>{_inline(" ".join(para))}</p>')
+    return out
+
+
+def _list(lines, i, depth):
+    """One list from lines[i]: (html, next index). Items hold inline text; nested items form one level."""
+    first = _item(lines[i])
+    base, ordered, delim, start = first[0], first[1], first[2], first[3]
+    items = []                  # [text parts, [[ordered, start, [item text parts...]], ...]]
+    n, previous_blank = len(lines), False
+    while i < n:
+        line = lines[i]
+        if not line.strip():
+            k = i + 1
+            while k < n and not lines[k].strip():
+                k += 1
+            nxt = _item(lines[k]) if k < n else None
+            sibling = nxt and nxt[0] < base + 2 and nxt[1] == ordered and nxt[2] == delim
+            if k < n and (sibling or _indent(lines[k]) >= base + 2):
+                i, previous_blank = k, True
+                continue
+            break
+        item, indent = _item(line), _indent(line)
+        if indent < base + 2 and item:
+            if item[1] != ordered or item[2] != delim:
+                break
+            items.append([[item[4]], []])
+        elif indent >= base + 2:
+            nested = _item(line.lstrip(' \t'))
+            children = items[-1][1]
+            if nested:
+                if not children or children[-1][0] != nested[1]:
+                    children.append([nested[1], nested[3], []])
+                children[-1][2].append([nested[4]])
+            elif children:
+                children[-1][2][-1].append(line.strip())
+            else:
+                items[-1][0].append(line.strip())
+        else:
+            if previous_blank or _starts_block(lines, i, depth):
+                break
+            children = items[-1][1]
+            (children[-1][2][-1] if children else items[-1][0]).append(line.strip())
+        previous_blank = False
+        i += 1
+    return _render_list(ordered, start, items, True), i
+
+
+def _render_list(ordered, start, items, top):
+    tag = 'ol' if ordered else 'ul'
+    parts = [f'<ol start="{start}">' if ordered and start != 1 else f'<{tag}>']
+    for item in items:
+        text = _inline(' '.join(p for p in (item[0] if top else item) if p))
+        children = item[1] if top else []
+        if children:
+            nested = '\n'.join(_render_list(o, s, kids, False) for o, s, kids in children)
+            parts.append(f'<li>{text}\n{nested}\n</li>')
+        else:
+            parts.append(f'<li>{text}</li>')
+    return '\n'.join(parts + [f'</{tag}>'])
+
+
+# ---------------------------------------------------------------------------------------------------------------------
+# Inline
+
+_SPECIAL = re.compile(r'[\\`*_!\[<]')
+_RUN = re.compile(r'`+')
+_DELIMS = re.compile(r'\*+|_+')
+_BRACKET_TOKEN = re.compile(r'\\[\s\S]|`+|[\[\]]')
+_ASCII_PUNCT = frozenset('!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~')
+_ESCAPED = re.compile(r'\\([!-/:-@\[-`{-~])')
+# (dest) — <angle form> or a raw form with one level of balanced parentheses — then an optional "t", 't' or (t) title.
+_DEST = re.compile(r'\([ \t]*(?:<([^<>\n]*)>|((?:[^\s()\\]|\\\S|\((?:[^\s()\\]|\\\S)*\))*))'
+                   r'(?:[ \t]+("(?:[^"\\]|\\.)*"|\'(?:[^\'\\]|\\.)*\'|\((?:[^()\\]|\\.)*\)))?[ \t]*\)')
+_AUTOLINK = re.compile(r'<([A-Za-z][A-Za-z0-9+.-]{1,31}:[^\x00-\x20\x7f<>]*)>')
+_EMAIL = re.compile(r"<([A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?"
+                    r"(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*)>")
+_HREF = re.compile(r'(?:(?i:https?://|mailto:)|/lanes-docs/|#)')
+_SRC = re.compile(r'/lanes-docs/d/[a-z0-9]{10,20}/(?:raw|artifact)|(?i:data:image/(?:png|jpeg|gif|webp);base64,)'
+                  r'[A-Za-z0-9+/]*={0,2}')                       # fullmatch: the whole src, nothing after it
+_WEB = re.compile(r'(?i:https?://)')
+_BAD_URL = re.compile(r'[\x00-\x20\x7f\\]')                      # a browser reads `\` as `/` in an http(s) URL
+_DOT_SEGMENT = re.compile(r'(?:\.|%2e){1,2}', re.I)              # fullmatch: `.` `..` `%2e` `.%2E` `%2e%2e` …
+_PATH_END = re.compile(r'[?#]')
+_ENCODED_SLASH = re.compile(r'%(?:2f|5c)', re.I)
+_EXTERNAL = ' rel="noopener noreferrer" target="_blank"'
+
+
+def _runs(s):
+    """{run length: [start of each maximal backtick run of that length]}, ascending."""
+    by_length = {}
+    for m in _RUN.finditer(s):
+        by_length.setdefault(m.end() - m.start(), []).append(m.start())
+    return by_length
+
+
+def _closer(runs, at, length):
+    """Where the code span opened by the run of `length` backticks at `at` closes (the next maximal run of exactly that
+    length), or None: the run is literal."""
+    starts = runs.get(length)
+    if not starts:
+        return None
+    k = bisect.bisect_right(starts, at)
+    return starts[k] if k < len(starts) else None
+
+
+def _cells(line):
+    """A table row's cells: split on | outside code spans; \\| is a literal | (inside a code span too)."""
+    s = line.strip()
+    if s.startswith('|'):
+        s = s[1:]
+    if '`' not in s and '\\' not in s:
+        cells = [cell.strip() for cell in s.split('|')]
+        return cells[:-1] if len(cells) > 1 and s.endswith('|') else cells
+    runs, cells, cur, pos, last, split_last = _runs(s), [], [], 0, 0, False
+    while (m := _CELL_TOKEN.search(s, pos)) is not None:
+        token, pos, split_last = m.group(), m.end(), False
+        if token[0] == '`':
+            close = _closer(runs, m.start(), len(token))
+            if close is not None:
+                cur += [s[last:m.start()], s[m.start():close + len(token)].replace('\\|', '|')]
+                last = pos = close + len(token)
+        elif token == '|':
+            cur.append(s[last:m.start()])
+            cells.append(''.join(cur).strip())
+            cur, last, split_last = [], pos, True
+    if not (split_last and last == len(s)):
+        cells.append((''.join(cur) + s[last:]).strip())
+    return cells
+
+
+def _brackets(s, runs):
+    """{index of [: index of its matching ]}, skipping backslash escapes and code spans as the scanner does."""
+    match, stack, pos = {}, [], 0
+    while (m := _BRACKET_TOKEN.search(s, pos)) is not None:
+        token, pos = m.group(), m.end()
+        if token[0] == '`':
+            close = _closer(runs, m.start(), len(token))
+            if close is not None:
+                pos = close + len(token)
+        elif token == '[':
+            stack.append(m.start())
+        elif token == ']' and stack:
+            match[stack.pop()] = m.start()
+    return match
+
+
+def _class(ch):
+    """' ' whitespace, 'p' punctuation (ASCII, or a Unicode P* or S* category), 'w' anything else: the flanking rule's
+    three kinds of neighbour."""
+    kind = _ASCII_CLASS.get(ch)
+    if kind is None:
+        kind = ' ' if ch.isspace() else 'p' if unicodedata.category(ch)[0] in 'PS' else 'w'
+    return kind
+
+
+_ASCII_CLASS = {chr(c): ' ' if chr(c).isspace() else 'p' if chr(c) in _ASCII_PUNCT else 'w' for c in range(128)}
+
+
+class _Delim:
+    """A run of * or _: literal until the emphasis pass pairs it; then it carries the tags it opens or closes."""
+    __slots__ = ('char', 'count', 'can_open', 'can_close', 'opens', 'closes')
+
+    def __init__(self, char, count, before, after):
+        left = after != ' ' and (after != 'p' or before != 'w')
+        right = before != ' ' and (before != 'p' or after != 'w')
+        if char == '*':
+            self.can_open, self.can_close = left, right
+        else:
+            self.can_open, self.can_close = left and (not right or before == 'p'), right and (not left or after == 'p')
+        self.char, self.count, self.opens, self.closes = char, count, [], []
+
+    def html(self):
+        return ''.join(self.closes) + self.char * self.count + ''.join(self.opens)
+
+
+def _emphasis(nodes):
+    """CommonMark's process-emphasis over the delimiter runs (no rule of three); every pair encloses a contiguous
+    stretch, so the tags nest. The opener stack grows as the runs are reached, so every removal is at its top, and a
+    failed search raises that character's floor: linear in the number of runs."""
+    stack, floor = [], {'*': -1, '_': -1}
+    for k, closer in enumerate(nodes):
+        if not isinstance(closer, _Delim):
+            continue
+        while closer.can_close and closer.count:
+            found = len(stack) - 1
+            while found >= 0 and stack[found] > floor[closer.char]:
+                candidate = nodes[stack[found]]
+                if candidate.char == closer.char and candidate.can_open:
+                    break
+                found -= 1
+            else:
+                floor[closer.char] = k - 1
+                break
+            opener = nodes[stack[found]]
+            use = 2 if opener.count >= 2 and closer.count >= 2 else 1
+            tag = 'strong' if use == 2 else 'em'
+            opener.count -= use
+            closer.count -= use
+            opener.opens.insert(0, f'<{tag}>')
+            closer.closes.append(f'</{tag}>')
+            del stack[found + 1:]                       # the runs between the pair stay literal
+            if not opener.count:
+                stack.pop()
+        if closer.count and closer.can_open:
+            stack.append(k)
+    return ''.join(node.html() if isinstance(node, _Delim) else node for node in nodes)
+
+
+def _target(m):
+    """(url or None, title or None) of a _DEST match, backslash escapes resolved."""
+    if m.group(1) is not None:
+        url = _ESCAPED.sub(r'\1', m.group(1)).replace(' ', '%20')
+    else:
+        url = _ESCAPED.sub(r'\1', m.group(2))
+    title = _ESCAPED.sub(r'\1', m.group(3)[1:-1]) if m.group(3) else None
+    return (url if url and not _BAD_URL.search(url) else None), title
+
+
+def _title(title):
+    return f' title="{_esc(title)}"' if title else ''
+
+
+def _href_ok(url):
+    """Whether `url` (escapes resolved, _BAD_URL-free) may be a link: an allowed start, and no `.`/`..` segment in its
+    path — the part before `?` or `#`, after the authority of an http(s) URL (mailto: and # have none); a path on this
+    site (`/lanes-docs/…`) also no encoded slash or backslash (`%2f`, `%5c`), which a server may decode into one."""
+    if not _HREF.match(url):
+        return False
+    if url[:1] == '/':
+        path = url
+        if _ENCODED_SLASH.search(_PATH_END.split(path, 1)[0]):
+            return False
+    elif _WEB.match(url):
+        rest = url[url.index('//') + 2:]
+        start = min((at for at in (rest.find('/'), rest.find('?'), rest.find('#')) if at >= 0), default=len(rest))
+        path = rest[start:] if rest[start:start + 1] == '/' else ''
+    else:
+        return True
+    path = _PATH_END.split(path, 1)[0]
+    return not any(_DOT_SEGMENT.fullmatch(segment) for segment in path.split('/'))
+
+
+def _link(s, opening, closing):
+    m = _DEST.match(s, closing + 1)
+    if not m:
+        return None
+    url, title = _target(m)
+    text = _inline(s[opening + 1:closing], in_link=True)
+    if url is None or not _href_ok(url):
+        return text, m.end()                            # the text stays, the destination is dropped
+    return f'<a href="{_esc(url)}"{_title(title)}{_EXTERNAL if _WEB.match(url) else ""}>{text}</a>', m.end()
+
+
+def _image(s, opening, closing):
+    m = _DEST.match(s, closing + 1)
+    if not m:
+        return None
+    url, title = _target(m)
+    alt = _ESCAPED.sub(r'\1', s[opening + 1:closing])
+    if url is None or not _SRC.fullmatch(url):
+        return _esc(alt), m.end()                       # the alt text stays, the image is dropped
+    return f'<img src="{_esc(url)}" alt="{_esc(alt)}"{_title(title)}>', m.end()
+
+
+def _autolink(s, at):
+    m = _AUTOLINK.match(s, at)
+    if m:
+        url = m.group(1)
+        if '\\' in url or not _href_ok(url):
+            return None                                 # a scheme off the allowlist: the whole thing is text
+        return f'<a href="{_esc(url)}"{_EXTERNAL if _WEB.match(url) else ""}>{_esc(url)}</a>', m.end()
+    m = _EMAIL.match(s, at)
+    if m:
+        return f'<a href="mailto:{_esc(m.group(1))}">{_esc(m.group(1))}</a>', m.end()
+    return None
+
+
+def _inline(s, in_link=False):
+    """One block's inline text as HTML: text escaped once, the constructs above as tags."""
+    if _SPECIAL.search(s) is None:
+        return _esc(s)
+    runs = _runs(s) if '`' in s else {}
+    brackets = _brackets(s, runs) if '[' in s else {}
+    nodes, text, i, n, delims = [], [], 0, len(s), False
+    search, append = _SPECIAL.search, text.append
+    while i < n:
+        m = search(s, i)
+        if m is None:
+            append(s[i:])
+            break
+        j = m.start()
+        if j > i:
+            append(s[i:j])
+        c, done = s[j], None
+        if c == '\\':
+            if j + 1 < n and s[j + 1] in _ASCII_PUNCT:
+                append(s[j + 1])
+                i = j + 2
+            else:
+                append('\\')
+                i = j + 1
+            continue
+        if c == '`':
+            length = _RUN.match(s, j).end() - j
+            close = _closer(runs, j, length)
+            if close is None:
+                append('`' * length)
+                i = j + length
+                continue
+            code = s[j + length:close]
+            if len(code) > 1 and code[0] == ' ' and code[-1] == ' ' and code.strip(' '):
+                code = code[1:-1]
+            done = f'<code>{_esc(code)}</code>', close + length
+        elif c == '*' or c == '_':
+            end = _DELIMS.match(s, j).end()
+            run = _Delim(c, end - j, _class(s[j - 1]) if j else ' ', _class(s[end]) if end < n else ' ')
+            i = end
+            if run.can_open or run.can_close:
+                if text:
+                    nodes.append(_esc(''.join(text)))
+                    text.clear()
+                nodes.append(run)
+                delims = True
+            else:
+                append(s[j:end])                         # can neither open nor close (snake_case, a * b): text
+            continue
+        elif c == '!' and j + 1 < n and s[j + 1] == '[' and j + 1 in brackets:
+            done = _image(s, j + 1, brackets[j + 1])
+        elif c == '[' and not in_link and j in brackets:
+            done = _link(s, j, brackets[j])
+        elif c == '<' and not in_link:
+            done = _autolink(s, j)
+        if done is None:
+            append(c)
+            i = j + 1
+            continue
+        if text:
+            nodes.append(_esc(''.join(text)))
+            text.clear()
+        nodes.append(done[0])
+        i = done[1]
+    if text:
+        nodes.append(_esc(''.join(text)))
+    return _emphasis(nodes) if delims else ''.join(nodes)
+
+
+# ---------------------------------------------------------------------------------------------------------------------
+
+def render(text: str) -> str:
+    """Markdown text -> an HTML fragment (see the module docstring for the subset and the safety contract)."""
+    if not isinstance(text, str):
+        raise TypeError(f'render() takes str, not {type(text).__name__}')
+    size = len(text.encode('utf-8', 'surrogatepass'))
+    if size > MAX_BYTES:
+        raise TooLarge(size)
+    text = re.sub('[\ud800-\udfff]', '\ufffd', text.replace('\r\n', '\n').replace('\r', '\n').replace('\0', '\ufffd'))
+    blocks = _blocks(text.split('\n'), 0)
+    return '\n'.join(blocks) + '\n' if blocks else ''
+
+
+def main(argv):
+    if len(argv) > 2:
+        sys.exit('usage: python3 mdlite.py [FILE]')
+    with (open(argv[1], encoding='utf-8') if len(argv) == 2 else sys.stdin) as source:
+        text = source.read()
+    try:
+        sys.stdout.write(render(text))
+    except TooLarge as error:
+        sys.exit(f'mdlite: {error}')
+
+
+if __name__ == '__main__':
+    main(sys.argv)

package/payload/lanes/libexec/members.py

@@ -16,6 +16,11 @@ One JSON file per enrolled device under ~/.local/state/lanes/members/ (directory
     (`Tailscale-User-Login`; outside request mode the invite's email, or its name when that is a handle), `name`
     and `email` may be null. `via` is invite|request|manual; an invite record carries its `invite_id`, a request
     record its `request_id`, a manual one neither. `approved_by` is a login or null; `workspaces` lists board ids.
+    What `workspaces` means (DEF-1852): only the docs service reads it (docsd.member_workspaces: the boards whose
+    shared documents and upload lanes a member gets; a view shows every board whatever it says). A record that lists
+    boards — an invite's `--workspaces`, copied at redeem — grants those; a record whose list is empty or absent — a
+    key added by hand (`lanes keys add|adopt`, the operator's own case), a request, an invite minted without
+    `--workspaces` — grants every workspace the host serves. An empty list therefore never means "no board".
   * `invited_as` (optional, additive; an invite record only) is the invite's own {name, email} when a TRUSTED tailnet
     caller redeemed it (request mode): the owner is then the caller, whoever the invite was minted for, and this keeps
     who it was minted for beside it. Absent when no trusted caller redeemed (the owner then came from the invite).