@zvndev/darkmown 2.12.3 → 2.13.0

package/AGENTS.md

@@ -5,6 +5,7 @@ Darkmown is a Markdown-native web framework. You build sites by writing `.md` an
 ## The one rule
 
 - `.md` files are plain CommonMark. Directives stay inert text.
+- `.wd` adds read-only task lists: `- [ ] item` and `- [x] item` render as checkboxes, with no runtime. For a checkbox the reader can tick, use `:checkbox`.
 - `.wd` files are the same Markdown **plus directives** (state, loops, conditionals, includes, forms).
 - To make a `.md` page interactive, **rename it to `.wd`**. ⚠️ Renaming means the old `.md` is **gone** — never leave both `index.md` and `index.wd`, that is a fatal `Duplicate route` build error. Upgrade = delete the `.md`, create the `.wd`.
 - Static pages ship **zero** JavaScript; a page loads the ~6.6 KB gzipped runtime (CI-enforced under 8 KB) only if it declares reactive behavior. What ships at `/__wd/runtime.js` is a minified build of the readable source, with a sourcemap beside it at `/__wd/runtime.js.map`.

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to Darkmown are documented here. Versions follow [semver](https://semver.org); pre-1.0 minor versions may contain breaking changes.
 
+## 2.13.0 (2026-11-01)
+
+### Added
+
+- `.wd` task lists: `- [ ] item` and `- [x] item` render as read-only checkboxes, with no runtime. `.md` stays strict CommonMark.
+
+## 2.12.4 (2026-11-01)
+
+Closes what the 2026-10-23 audit got past the 2.12.3 security pass, and stops two kinds of broken page from passing `validate` as clean.
+
+### Security
+
+- Raw-HTML interpolation now reads a fragment the way the browser's tokenizer does. A `>` inside an earlier quoted value (`<button title=">" onclick="{ x }">`) no longer hides the attribute from the guard.
+- A value in a `<script>` or `<style>` body is dropped with a warning. JSON scripts such as `application/ld+json` still take values.
+- `to`, `from`, `by` and each entry of `values` get the URL scheme check, closing SVG `<animate>` and `<set>`.
+- `<{ x }>` can no longer choose the tag name.
+- The dev and preview servers apply the cross-site guard to every URL the `api/` runner serves, including `/api` itself.
+- Host-only files are refused in any letter case, for macOS and Windows filesystems.
+- A `:fetch` placeholder holding `[".."]` is treated as missing, like `..`.
+- The generated Cloudflare worker answers malformed percent-encoding with a 400 instead of throwing.
+
+### Warnings
+
+- `{ name }` that matches nothing now warns with its line and the nearest declared name. It still ships as literal text. Write `\{ name }` to show braces on purpose.
+- A `:fetch` URL reading a name the page never declares now warns, since the request will not fire until something sets it.
+
+### Fixed
+
+- The MCP stdio test accepts a prerelease version, which had been failing every canary since 2026-10-15.
+
 ## 2.12.3 (2026-10-22)
 
 A security pass over the runtime, the compiler's output escaping, and the local servers. Nothing found executed script on a default (`html: false`) page; the fixes close denial-of-service, redirect, and leak paths, plus script injection on `html: true` pages fed by data.

package/README.md

@@ -103,6 +103,7 @@ npm run dev     # live demo site — the same site that runs darkmown.com
 
 - `site/pages` is the route tree. `.md` and `.wd` files become pages.
 - `.md` is strict CommonMark (real parser: ordered lists, tables, blockquotes, images, the lot). Directives stay plain text, and the build hints when it spots `.wd` syntax in a `.md` file.
+- `.wd` adds read-only task lists: `- [ ] item` and `- [x] item` render as checkboxes, with no runtime. For a checkbox the reader can tick, use `:checkbox`.
 - Files or folders starting with `.`, `-`, or `_` are hidden from routing.
 - `site/_` is the include shelf for `@include /name.wd`.
 - Matching `page.skin` and `page.js` colocate styling and behavior by basename.

package/docs/spec-alignment.md

@@ -115,6 +115,7 @@ The 1.3.0 cycle shipped the crawler *files* (sitemap, rss, robots). This closes
 ## Fundamentally aligned
 
 - **Markdown-first authoring:** `.md` is strict CommonMark rendered by a real parser (markdown-it); `.wd` is the same Markdown plus first-party directives. Renaming the file is the upgrade path — extensions genuinely gate functionality.
+- **Task lists in `.wd`:** `- [ ]` and `- [x]` compile to read-only checkboxes in `.wd` only, as static output. `.md` stays strict CommonMark. Covered by `tests/task-lists.test.js`.
 - **Content tree over components:** routing, includes, and repeated fragments are file/document based instead of React-style components.
 - **Tiered output:** static routes emit HTML/CSS and no Darkmown runtime; reactive routes opt into `/__wd/runtime.js`, a minified build of the readable source with a sourcemap beside it (~6.6 KB gzipped, CI-enforced below the 8 KB target).
 - **No virtual DOM:** state changes patch direct DOM bindings, conditional regions, and keyed loop regions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zvndev/darkmown",
-  "version": "2.12.3",
+  "version": "2.13.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/site/pages/docs/index.wd

@@ -91,6 +91,7 @@ For editing, there is a VS Code extension for `.wd` and `.skin` files: see [Edit
 ## The two formats
 
 - `.md` is strict CommonMark. Directives, includes, and `{ bindings }` stay plain text, and the build prints a hint if it spots `.wd` syntax in a `.md` file.
+- `.wd` adds read-only task lists: `- [ ] item` and `- [x] item` render as checkboxes, with no runtime. For a checkbox the reader can tick, use `:checkbox`.
 - `.wd` is Markdown plus directives. Renaming a file from `.md` to `.wd` is the upgrade path — nothing else changes.
 
 ## Routing rules