superbee 0.4.4-pre.9 → 0.4.5-pre.1

package/dist/publication.mjs

@@ -63,8 +63,8 @@ var require_common = __commonJS({
       return target;
     }
     function repeat(string3, count) {
-      var result = "", cycle;
-      for (cycle = 0; cycle < count; cycle += 1) {
+      var result = "", cycle2;
+      for (cycle2 = 0; cycle2 < count; cycle2 += 1) {
         result += string3;
       }
       return result;
@@ -30835,6 +30835,14 @@ var InvalidInputError = class extends Error {
     this.name = "InvalidInputError";
   }
 };
+var FrontmatterRefusedError = class extends InvalidInputError {
+  code;
+  constructor(code2, detail) {
+    super(`frontmatter cannot be stored: ${detail}`);
+    this.name = "FrontmatterRefusedError";
+    this.code = code2;
+  }
+};
 var FilesystemIdentityAliasError = class extends InvalidInputError {
   rel;
   segment;
@@ -30859,12 +30867,21 @@ var ConcurrentReplacementError = class extends Error {
   }
 };
 
-// ../core/src/portable-frontmatter.ts
+// ../core/src/bounded-yaml.ts
 var import_js_yaml = __toESM(require_js_yaml2(), 1);
 
 // ../core/src/frontmatter-contract.ts
+var FrontmatterLimitError = class extends Error {
+  name = "FrontmatterLimitError";
+  code;
+  constructor(code2, message) {
+    super(message);
+    this.code = code2;
+  }
+};
 var MalformedDocumentError = class extends Error {
   name = "MalformedDocumentError";
+  code;
   context;
   detail;
   constructor(context, cause) {
@@ -30872,12 +30889,165 @@ var MalformedDocumentError = class extends Error {
     super(
       `malformed frontmatter${context ? ` in '${context}'` : ""}: ${detail} \u2014 fix the YAML or remove the file`
     );
+    this.code = cause instanceof FrontmatterLimitError ? cause.code : "FRONTMATTER_MALFORMED";
     if (context !== void 0) this.context = context;
     this.detail = detail;
     if (cause !== void 0) this.cause = cause;
   }
 };
 
+// ../core/src/bounded-yaml.ts
+var FRONTMATTER_LIMITS = Object.freeze({
+  sourceChars: 256 * 1024,
+  depth: 32,
+  aliases: 1e3,
+  expandedNodes: 1e5,
+  expandedChars: 1024 * 1024
+});
+var PARSE_NESTING_GUARD = FRONTMATTER_LIMITS.depth * 4;
+function tooDeep() {
+  return new FrontmatterLimitError("FRONTMATTER_TOO_DEEP", `YAML nesting is deeper than ${FRONTMATTER_LIMITS.depth} levels`);
+}
+function tooLarge() {
+  return new FrontmatterLimitError(
+    "FRONTMATTER_ALIAS_LIMIT",
+    `YAML aliases expand to more than ${FRONTMATTER_LIMITS.expandedNodes} nodes or ${FRONTMATTER_LIMITS.expandedChars} characters`
+  );
+}
+function cycle() {
+  return new FrontmatterLimitError("FRONTMATTER_CYCLE", "YAML aliases form a cycle");
+}
+function scalarExtent(value) {
+  const chars = typeof value === "string" ? value.length : ArrayBuffer.isView(value) ? value.byteLength : 0;
+  return { nodes: 1, chars, depth: 0 };
+}
+function isCollection(value) {
+  if (Array.isArray(value)) return true;
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+var ExtentMeter = class {
+  known = /* @__PURE__ */ new Map();
+  path = /* @__PURE__ */ new Set();
+  unfinished;
+  constructor(unfinished = /* @__PURE__ */ new Set()) {
+    this.unfinished = unfinished;
+  }
+  measure(value) {
+    if (!isCollection(value)) return scalarExtent(value);
+    const known = this.known.get(value);
+    if (known !== void 0) return known;
+    if (this.path.has(value) || this.unfinished.has(value)) throw cycle();
+    return this.walk(value);
+  }
+  walk(value) {
+    if (this.path.size >= FRONTMATTER_LIMITS.depth) throw tooDeep();
+    this.path.add(value);
+    const keyed = !Array.isArray(value);
+    const extent = { nodes: 1, chars: 0, depth: 1 };
+    for (const [key, child] of Object.entries(value)) {
+      const inner = this.measure(child);
+      extent.nodes += inner.nodes;
+      extent.chars += inner.chars + (keyed ? key.length : 0);
+      extent.depth = Math.max(extent.depth, inner.depth + 1);
+      if (extent.nodes > FRONTMATTER_LIMITS.expandedNodes || extent.chars > FRONTMATTER_LIMITS.expandedChars) throw tooLarge();
+      if (extent.depth > FRONTMATTER_LIMITS.depth) throw tooDeep();
+    }
+    this.path.delete(value);
+    this.known.set(value, extent);
+    return extent;
+  }
+};
+var AliasBudget = class {
+  unfinished = /* @__PURE__ */ new Set();
+  finished = /* @__PURE__ */ new Set();
+  meter = new ExtentMeter(this.unfinished);
+  aliases = 0;
+  nodes = 0;
+  chars = 0;
+  /** Wrap the parser's anchor table; the parser reads it only to resolve an alias. */
+  watch(state) {
+    state.anchorMap = new Proxy(state.anchorMap, {
+      get: (target, name, receiver) => {
+        const value = Reflect.get(target, name, receiver);
+        if (typeof name === "string") this.charge(name, value);
+        return value;
+      },
+      set: (target, name, value, receiver) => {
+        if (typeof name === "string") {
+          this.finished.delete(name);
+          if (isCollection(value)) this.unfinished.add(value);
+        }
+        return Reflect.set(target, name, value, receiver);
+      }
+    });
+  }
+  /** Called when an anchored node closes: its anchor now names a complete value. */
+  close(anchor, value) {
+    this.finished.add(anchor);
+    if (isCollection(value)) this.unfinished.delete(value);
+  }
+  charge(name, value) {
+    this.aliases += 1;
+    if (this.aliases > FRONTMATTER_LIMITS.aliases) {
+      throw new FrontmatterLimitError(
+        "FRONTMATTER_ALIAS_LIMIT",
+        `YAML aliases are used more than ${FRONTMATTER_LIMITS.aliases} times`
+      );
+    }
+    if (!this.finished.has(name) && isCollection(value)) throw cycle();
+    const extent = this.meter.measure(value);
+    this.nodes += extent.nodes;
+    this.chars += extent.chars;
+    if (this.nodes > FRONTMATTER_LIMITS.expandedNodes || this.chars > FRONTMATTER_LIMITS.expandedChars) throw tooLarge();
+  }
+};
+var MERGE_KEY_LIMIT_REASON = "merge keys exceeded maxTotalMergeKeys";
+function loadBoundedYaml(source, options = {}) {
+  if (source.length > FRONTMATTER_LIMITS.sourceChars) {
+    throw new FrontmatterLimitError(
+      "FRONTMATTER_TOO_LARGE",
+      `YAML source is longer than ${FRONTMATTER_LIMITS.sourceChars} characters`
+    );
+  }
+  const schema = options.schema === "json" ? import_js_yaml.default.JSON_SCHEMA : options.schema;
+  const budget = new AliasBudget();
+  let watched;
+  let nesting = 0;
+  let value;
+  try {
+    value = import_js_yaml.default.safeLoad(source, {
+      ...schema ? { schema } : {},
+      listener(event, rawState) {
+        const state = rawState;
+        if (state.anchorMap !== watched) {
+          budget.watch(state);
+          watched = state.anchorMap;
+        }
+        if (event === "open") {
+          nesting += 1;
+          if (nesting > PARSE_NESTING_GUARD) throw tooDeep();
+        } else {
+          nesting -= 1;
+          if (state.anchor !== null) budget.close(state.anchor, state.result);
+        }
+      }
+    });
+  } catch (error) {
+    const reason = error.reason;
+    if (typeof reason === "string" && reason.startsWith(MERGE_KEY_LIMIT_REASON)) {
+      throw new FrontmatterLimitError("FRONTMATTER_ALIAS_LIMIT", reason);
+    }
+    throw error;
+  }
+  new ExtentMeter().measure(value);
+  return value;
+}
+
+// ../core/src/frontmatter.ts
+var import_js_yaml2 = __toESM(require_js_yaml2(), 1);
+
 // ../core/src/frontmatter-splitter.ts
 function delimiterLineEnd(input, offset) {
   if (!input.startsWith("---", offset)) return null;
@@ -30907,12 +31077,106 @@ function splitLeadingFrontmatter(raw, context) {
   throw new MalformedDocumentError(context, new Error("unterminated YAML frontmatter delimiter"));
 }
 
+// ../core/src/frontmatter.ts
+var YAML_TIMESTAMP_TAG = "tag:yaml.org,2002:timestamp";
+function requireYamlTimestampType() {
+  const type = import_js_yaml2.default.DEFAULT_SAFE_SCHEMA.implicit.find(
+    (candidate) => candidate.tag === YAML_TIMESTAMP_TAG
+  );
+  if (!type) throw new Error("js-yaml safe schema is missing its timestamp type");
+  return type;
+}
+var yamlTimestampType = requireYamlTimestampType();
+var stringTimestampType = new import_js_yaml2.default.Type(YAML_TIMESTAMP_TAG, {
+  kind: "scalar",
+  resolve: (value) => yamlTimestampType.resolve(value),
+  construct: (value) => value
+});
+var losslessDateSchema = new import_js_yaml2.default.Schema({
+  include: [import_js_yaml2.default.DEFAULT_SAFE_SCHEMA],
+  implicit: [stringTimestampType]
+});
+var yamlEngine = {
+  parse(input) {
+    return loadBoundedYaml(input, { schema: losslessDateSchema }) ?? {};
+  }
+};
+function normalizeFrontmatter(data, options) {
+  const out = { ...data };
+  if (options.preserveTimestamp || options.okfVersion === "0.2") return out;
+  const value = out.timestamp;
+  if (value instanceof Date) {
+    out.timestamp = value.toISOString();
+  } else if (typeof value === "number" && Number.isFinite(value)) {
+    out.timestamp = new Date(value).toISOString();
+  } else if (typeof value === "string" && yamlTimestampType.resolve(value)) {
+    const parsed = yamlTimestampType.construct(value);
+    if (parsed instanceof Date) out.timestamp = parsed.toISOString();
+  }
+  return out;
+}
+function parseMarkdown(raw, context, options = {}) {
+  const split = splitLeadingFrontmatter(raw, context);
+  if (!("yamlSource" in split)) return { frontmatter: {}, body: split.body };
+  return { frontmatter: parseFrontmatter(split.yamlSource, context, options), body: split.body };
+}
+function parseFrontmatter(source, context, options = {}) {
+  let parsed;
+  try {
+    parsed = yamlEngine.parse(source);
+  } catch (err) {
+    throw new MalformedDocumentError(context, err);
+  }
+  return normalizeFrontmatter(parsed, options);
+}
+function isStackExhaustion(error) {
+  if (error instanceof RangeError) return /call stack/i.test(error.message);
+  return error?.name === "InternalError" && /recursion/i.test(error.message);
+}
+function stringifyFrontmatter(data) {
+  let dumped;
+  try {
+    dumped = import_js_yaml2.default.safeDump(data).trim();
+  } catch (error) {
+    if (isStackExhaustion(error)) throw new FrontmatterRefusedError("FRONTMATTER_TOO_DEEP", `YAML nesting is deeper than ${FRONTMATTER_LIMITS.depth} levels`);
+    throw error;
+  }
+  try {
+    yamlEngine.parse(`${dumped}
+`);
+  } catch (error) {
+    if (error instanceof FrontmatterLimitError) throw new FrontmatterRefusedError(error.code, error.message);
+    const detail = (error instanceof Error ? error.message : String(error)).split("\n")[0] ?? "";
+    throw new FrontmatterRefusedError("FRONTMATTER_MALFORMED", detail);
+  }
+  return dumped;
+}
+function normalizeDocumentBodyForStorage(body) {
+  return body.endsWith("\n") ? body : `${body}
+`;
+}
+function stringifyWithData(data, body) {
+  return stringifyWithSerializedFrontmatter(stringifyFrontmatter(data), body);
+}
+function stringifyWithSerializedFrontmatter(dumped, body) {
+  const content3 = body ?? "";
+  const newline = (value) => value.endsWith("\n") ? value : `${value}
+`;
+  if (dumped === "{}") return normalizeDocumentBodyForStorage(content3);
+  return `---
+${newline(dumped)}---
+${normalizeDocumentBodyForStorage(content3)}`;
+}
+function stringifyDoc(frontmatter2, body) {
+  return stringifyWithData(frontmatter2, body);
+}
+
 // ../core/src/portable-frontmatter.ts
 function parseLeadingFrontmatter(raw, context) {
   const split = splitLeadingFrontmatter(raw, context);
   if (!("yamlSource" in split)) return {};
   try {
-    const parsed = import_js_yaml.default.safeLoad(split.yamlSource);
+    const parsed = loadBoundedYaml(split.yamlSource);
     if (parsed === void 0 || parsed === null) return {};
     if (typeof parsed !== "object" || Array.isArray(parsed)) {
       throw new TypeError("YAML frontmatter must be a mapping");
@@ -30923,6 +31187,18 @@ function parseLeadingFrontmatter(raw, context) {
     throw new MalformedDocumentError(context, error);
   }
 }
+function assertStorableFrontmatter(raw) {
+  try {
+    parseLeadingFrontmatter(raw);
+    const split = splitLeadingFrontmatter(raw);
+    if ("yamlSource" in split) parseFrontmatter(split.yamlSource);
+  } catch (error) {
+    if (error instanceof MalformedDocumentError && error.code !== "FRONTMATTER_MALFORMED") {
+      throw new FrontmatterRefusedError(error.code, error.detail);
+    }
+    if (!(error instanceof MalformedDocumentError)) throw error;
+  }
+}
 
 // ../core/src/paths.ts
 var RESERVED_FILENAMES = ["index.md", "log.md"];
@@ -30956,6 +31232,17 @@ function isReservedFile(relPath) {
   const base = toPosix(relPath).split("/").pop() ?? "";
   return RESERVED_FILENAMES.includes(base);
 }
+function isHiddenWalkEntry(name) {
+  return name.startsWith(".");
+}
+function hasMarkdownExtension(name) {
+  return name.toLowerCase().endsWith(".md");
+}
+function classifyWalkPath(relPath) {
+  const segments = toPosix(relPath).split("/").filter((segment) => segment !== "");
+  if (segments.some(isHiddenWalkEntry)) return "hidden";
+  return hasMarkdownExtension(segments.at(-1) ?? "") ? "markdown" : "other";
+}
 function conceptIdFromPath(relPath) {
   const norm = toPosix(relPath).replace(/^\.?\//, "").split("/").filter((segment) => segment !== ".").join("/");
   return norm.endsWith(".md") ? norm.slice(0, -3) : norm;
@@ -31282,82 +31569,6 @@ function inventoryDigest(inventory) {
   return `sha256:${sha256HexOfUtf8(JSON.stringify(inventory.map((row) => [row.id, row.version])))}`;
 }
 
-// ../core/src/frontmatter.ts
-var import_js_yaml2 = __toESM(require_js_yaml2(), 1);
-var YAML_TIMESTAMP_TAG = "tag:yaml.org,2002:timestamp";
-function requireYamlTimestampType() {
-  const type = import_js_yaml2.default.DEFAULT_SAFE_SCHEMA.implicit.find(
-    (candidate) => candidate.tag === YAML_TIMESTAMP_TAG
-  );
-  if (!type) throw new Error("js-yaml safe schema is missing its timestamp type");
-  return type;
-}
-var yamlTimestampType = requireYamlTimestampType();
-var stringTimestampType = new import_js_yaml2.default.Type(YAML_TIMESTAMP_TAG, {
-  kind: "scalar",
-  resolve: (value) => yamlTimestampType.resolve(value),
-  construct: (value) => value
-});
-var losslessDateSchema = new import_js_yaml2.default.Schema({
-  include: [import_js_yaml2.default.DEFAULT_SAFE_SCHEMA],
-  implicit: [stringTimestampType]
-});
-var yamlEngine = {
-  parse(input) {
-    return import_js_yaml2.default.safeLoad(input, { schema: losslessDateSchema }) ?? {};
-  }
-};
-function normalizeFrontmatter(data, options) {
-  const out = { ...data };
-  if (options.preserveTimestamp || options.okfVersion === "0.2") return out;
-  const value = out.timestamp;
-  if (value instanceof Date) {
-    out.timestamp = value.toISOString();
-  } else if (typeof value === "number" && Number.isFinite(value)) {
-    out.timestamp = new Date(value).toISOString();
-  } else if (typeof value === "string" && yamlTimestampType.resolve(value)) {
-    const parsed = yamlTimestampType.construct(value);
-    if (parsed instanceof Date) out.timestamp = parsed.toISOString();
-  }
-  return out;
-}
-function parseMarkdown(raw, context, options = {}) {
-  const split = splitLeadingFrontmatter(raw, context);
-  if (!("yamlSource" in split)) return { frontmatter: {}, body: split.body };
-  return { frontmatter: parseFrontmatter(split.yamlSource, context, options), body: split.body };
-}
-function parseFrontmatter(source, context, options = {}) {
-  let parsed;
-  try {
-    parsed = yamlEngine.parse(source);
-  } catch (err) {
-    throw new MalformedDocumentError(context, err);
-  }
-  return normalizeFrontmatter(parsed, options);
-}
-function stringifyFrontmatter(data) {
-  return import_js_yaml2.default.safeDump(data).trim();
-}
-function normalizeDocumentBodyForStorage(body) {
-  return body.endsWith("\n") ? body : `${body}
-`;
-}
-function stringifyWithData(data, body) {
-  return stringifyWithSerializedFrontmatter(stringifyFrontmatter(data), body);
-}
-function stringifyWithSerializedFrontmatter(dumped, body) {
-  const content3 = body ?? "";
-  const newline = (value) => value.endsWith("\n") ? value : `${value}
-`;
-  if (dumped === "{}") return normalizeDocumentBodyForStorage(content3);
-  return `---
-${newline(dumped)}---
-${normalizeDocumentBodyForStorage(content3)}`;
-}
-function stringifyDoc(frontmatter2, body) {
-  return stringifyWithData(frontmatter2, body);
-}
-
 // ../core/src/code-unit-order.ts
 function compareCodeUnits(a, b) {
   return a < b ? -1 : a > b ? 1 : 0;
@@ -31769,24 +31980,7 @@ function hasSourceIdentity(sources, identity) {
   return Array.isArray(sources) && sources.some((entry) => matchesSourceIdentity(entry, identity));
 }
 
-// ../core/src/engine.ts
-async function readBundleOkfVersion(backend) {
-  const index2 = await backend.readReserved("", "index.md");
-  if (!index2) return void 0;
-  const value = parseLeadingFrontmatter(index2.content, "index.md").okf_version;
-  return typeof value === "string" && value.trim() !== "" ? value : void 0;
-}
-function assertReadableConceptId(id) {
-  assertSafeConceptId(id);
-  const rel = pathFromConceptId(id);
-  if (isReservedFile(rel)) {
-    throw new InvalidInputError(`'${id}' is a reserved file (index.md / log.md), not a concept document.`);
-  }
-}
-async function readDocVersioned(backend, id) {
-  assertReadableConceptId(id);
-  return backend.read(id);
-}
+// ../core/src/document-scan.ts
 function isEnoent(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
@@ -31817,6 +32011,25 @@ async function readManyExisting(backend, ids, onMalformed, onAliased) {
     return out;
   }
 }
+
+// ../core/src/engine.ts
+async function readBundleOkfVersion(backend) {
+  const index2 = await backend.readReserved("", "index.md");
+  if (!index2) return void 0;
+  const value = parseLeadingFrontmatter(index2.content, "index.md").okf_version;
+  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function assertReadableConceptId(id) {
+  assertSafeConceptId(id);
+  const rel = pathFromConceptId(id);
+  if (isReservedFile(rel)) {
+    throw new InvalidInputError(`'${id}' is a reserved file (index.md / log.md), not a concept document.`);
+  }
+}
+async function readDocVersioned(backend, id) {
+  assertReadableConceptId(id);
+  return backend.read(id);
+}
 async function scanMatching(backend, filter, onSkip) {
   const ids = await backend.list(filter.prefix);
   const results = [];
@@ -31935,6 +32148,13 @@ function resolveContentType(key, override) {
   return inferContentTypeFromDocKey(key) ?? DEFAULT_BLOB_CONTENT_TYPE;
 }
 
+// ../core/src/reserved-write.ts
+function assertStorableReservedWrite(dir, name, content3) {
+  assertSafeReservedDir(dir);
+  assertSafeReservedFilename(name);
+  if (name.endsWith(".md")) assertStorableFrontmatter(content3);
+}
+
 // ../core/src/filesystem-identity.ts
 import { promises as fs2 } from "node:fs";
 import path2 from "node:path";
@@ -33085,7 +33305,7 @@ async function walkFiles(port, root, keep, sub = "") {
   const entries = await port.entries(path3.join(root, sub)) ?? [];
   const out = [];
   for (const entry of entries) {
-    if (entry.name.startsWith(".")) continue;
+    if (isHiddenWalkEntry(entry.name)) continue;
     const rel = sub === "" ? entry.name : `${sub}/${entry.name}`;
     if (entry.kind === "directory") {
       out.push(...await walkFiles(port, root, keep, rel));
@@ -33289,8 +33509,7 @@ var FilesystemBackend = class _FilesystemBackend {
     return { content: content3, version: versionOfBytes(content3) };
   }
   async writeReserved(dir, name, content3, options = {}) {
-    assertSafeReservedDir(dir);
-    assertSafeReservedFilename(name);
+    assertStorableReservedWrite(dir, name, content3);
     const rel = reservedPath(dir, name);
     return this.#mutateExact(rel, async (target) => {
       if (options.expectedVersion !== void 0) {
@@ -33345,12 +33564,15 @@ var FilesystemBackend = class _FilesystemBackend {
     return observed.state === "exact" && observed.value.kind === "file";
   }
   async listBlobs(prefix) {
-    const files = await walkFiles(this.#port, this.#root, (name) => !name.toLowerCase().endsWith(".md"));
+    const files = await walkFiles(this.#port, this.#root, (name) => !hasMarkdownExtension(name));
     const keys2 = files.map(toPosix);
     const filtered = prefix ? keys2.filter((k) => k.startsWith(prefix)) : keys2;
     filtered.sort(compareStorageKeys);
     return filtered;
   }
+  classifyChangedPath(relPath) {
+    return classifyWalkPath(relPath);
+  }
   capabilities() {
     return {
       history: false,
@@ -43216,6 +43438,72 @@ function gfmFromMarkdown() {
   ];
 }
 
+// ../markdown-renderer/src/parse.ts
+var MAX_BLOCK_SCORE = 44e7;
+var MAX_BLOCK_EMPHASIS = 4e3;
+var MAX_EMPHASIS_SCORE = 1e8;
+var MAX_PIPES = 25e3;
+var MAX_LINE_MARKERS = 14e3;
+var MAX_TABLES = 2500;
+var MAX_LINE_NESTING = 64;
+var MAX_LINE_PREFIX = 512;
+var CONTAINER_MARKER = />|[-+*](?=[ \t]|$)|\d{1,9}[.)](?=[ \t]|$)|\[\^[^[\]\s]+\]:/my;
+function withinParseLimits(source) {
+  let emphasisSum = 0, score = 0, block = 0, emphasis = 0, pipes = 0, markers = 0, tables = 0;
+  let lineStart = 0, linePipes = 0, lineDashes = 0, blank = true, delimiterRow = true;
+  for (let i = 0; i <= source.length; i++) {
+    const code2 = i < source.length ? source.charCodeAt(i) : 10;
+    if (code2 === 13 && source.charCodeAt(i + 1) === 10) continue;
+    if (code2 === 10 || code2 === 13) {
+      let nesting = 0, prefix = 0, position2 = lineStart;
+      for (; ; ) {
+        while (source.charCodeAt(position2) === 32 || source.charCodeAt(position2) === 9) position2++;
+        CONTAINER_MARKER.lastIndex = position2;
+        if (!CONTAINER_MARKER.test(source)) break;
+        position2 = CONTAINER_MARKER.lastIndex;
+        prefix = position2 - lineStart;
+        nesting++;
+      }
+      if (nesting > MAX_LINE_NESTING || prefix > MAX_LINE_PREFIX) return false;
+      markers += nesting;
+      if (delimiterRow && linePipes > 0 && lineDashes > 0) tables++;
+      if (blank) {
+        score += block * block;
+        emphasisSum += emphasis * emphasis;
+        block = 0;
+        emphasis = 0;
+      } else {
+        block += 2;
+      }
+      lineStart = i + 1;
+      linePipes = lineDashes = 0;
+      blank = delimiterRow = true;
+      continue;
+    }
+    if (code2 === 32 || code2 === 9) continue;
+    blank = false;
+    if (code2 === 124) linePipes++, pipes++;
+    else if (code2 === 45) lineDashes++;
+    else if (code2 !== 58 && code2 !== 62) delimiterRow = false;
+    const alphanumeric = code2 >= 48 && code2 <= 57 || code2 >= 65 && code2 <= 90 || code2 >= 97 && code2 <= 122 || code2 >= 128;
+    if (!alphanumeric) block += code2 === 93 ? 2 : 1;
+    if ((code2 === 42 || code2 === 95 || code2 === 126) && ++emphasis > MAX_BLOCK_EMPHASIS) return false;
+  }
+  return (emphasisSum + emphasis * emphasis) / MAX_EMPHASIS_SCORE + (score + block * block) / MAX_BLOCK_SCORE + (markers / MAX_LINE_MARKERS) ** 2 + (tables / MAX_TABLES) ** 2 + (pipes / MAX_PIPES) ** 2 <= 1;
+}
+function isCallStackExhausted(error) {
+  return error instanceof Error && (error.name === "RangeError" || error.name === "InternalError") && /call stack|recursion/i.test(error.message);
+}
+function parseWithinLimits(source) {
+  if (!withinParseLimits(source)) return null;
+  try {
+    return fromMarkdown(source, { extensions: [gfm()], mdastExtensions: [gfmFromMarkdown()] });
+  } catch (error) {
+    if (isCallStackExhausted(error)) return null;
+    throw error;
+  }
+}
+
 // ../markdown-renderer/src/index.tsx
 var import_jsx_runtime = __toESM(require_jsx_runtime(), 1);
 function renderableConceptId(fromId, raw) {
@@ -43229,13 +43517,36 @@ function resolveBound(requested, max) {
   if (requested === void 0 || !Number.isFinite(requested) || requested < 1) return max;
   return Math.min(Math.floor(requested), max);
 }
-function textOf(node2) {
-  if (node2.type === "text" || node2.type === "inlineCode" || node2.type === "html") {
-    return node2.value ?? "";
+var MAX_STATIC_IMAGE_ASSETS = 4096;
+var STATIC_IMAGE_PATH = /^\/assets\/(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*[A-Za-z0-9][A-Za-z0-9._-]*\.(?:png|jpe?g|gif|webp|avif|svg)$/;
+function staticImageLookup(options) {
+  const lookup = /* @__PURE__ */ new Map();
+  if (options.profile !== "inert" || options.imageAssets === void 0) return lookup;
+  if (!Array.isArray(options.imageAssets) || options.imageAssets.length > MAX_STATIC_IMAGE_ASSETS) {
+    throw new TypeError("static image asset inventory must be a bounded array");
+  }
+  for (const path6 of options.imageAssets) {
+    if (typeof path6 !== "string" || path6.length > 2048 || path6.trim() !== path6 || !STATIC_IMAGE_PATH.test(path6)) {
+      throw new TypeError("static image asset paths must be canonical local image paths");
+    }
+    lookup.set(path6, path6);
+  }
+  return lookup;
+}
+function textOf(root) {
+  const parts = [];
+  const pending = [root];
+  while (pending.length > 0) {
+    const node2 = pending.pop();
+    if (node2.type === "text" || node2.type === "inlineCode" || node2.type === "html") {
+      parts.push(node2.value ?? "");
+      continue;
+    }
+    const children = node2.children;
+    if (!Array.isArray(children)) continue;
+    for (let i = children.length - 1; i >= 0; i--) pending.push(children[i]);
   }
-  const children = node2.children;
-  if (!Array.isArray(children)) return "";
-  return children.map((child) => textOf(child)).join("");
+  return parts.join("");
 }
 function renderTextFallback(node2, index2) {
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "doc-markdown-fallback", children: textOf(node2) }, index2);
@@ -43288,16 +43599,19 @@ function admitFragment(raw) {
   }
   return fragment.length <= MAX_FRAGMENT_LENGTH && SAFE_FRAGMENT.test(fragment) ? fragment : null;
 }
-function admitExternalLink(raw, hosts) {
-  if (!Array.isArray(hosts) || hosts.length === 0) return null;
+function admitExternalLink(raw, policy) {
+  const anyHost = policy === "https";
+  const hosts = typeof policy === "object" && policy !== null ? policy.hosts : void 0;
+  if (!anyHost && (!Array.isArray(hosts) || hosts.length === 0)) return null;
   let url;
   try {
     url = new URL(raw);
   } catch {
     return null;
   }
-  if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.port !== "") return null;
-  if (isIpLiteralHost(url.hostname)) return null;
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "") return null;
+  if (anyHost) return url.href;
+  if (url.port !== "") return null;
   for (const entry of hosts) {
     if (normalizeAllowedHost(entry) === url.hostname) return url.href;
   }
@@ -43379,10 +43693,14 @@ function renderNode(node2, state, depth, index2) {
     case "link": {
       const raw = node2.url ?? "";
       const resolved = renderableConceptId(state.options.fromId, raw);
+      const insideLink = state.insideLink;
+      state.insideLink = true;
       const children = renderChildren(node2, state, depth);
+      state.insideLink = insideLink;
       if (resolved === null) {
-        const external = admitExternalLink(raw, state.options.externalLinkHosts);
-        if (external !== null) {
+        const hasContent = /\S/.test(textOf(node2)) || node2.children.some((child) => child.type === "image");
+        const external = admitExternalLink(raw, state.options.externalLinks);
+        if (external !== null && !insideLink && hasContent) {
           return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { href: external, rel: "noopener noreferrer", target: "_blank", className: "doc-link-external", children }, index2);
         }
         const fragment = admitFragment(raw);
@@ -43410,7 +43728,21 @@ function renderNode(node2, state, depth, index2) {
         index2
       );
     }
-    case "image":
+    case "image": {
+      const source = state.imageAssets.get(node2.url ?? "");
+      if (source !== void 0) {
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "img",
+          {
+            src: source,
+            alt: node2.alt ?? "",
+            loading: "lazy",
+            decoding: "async",
+            referrerPolicy: "no-referrer"
+          },
+          index2
+        );
+      }
       return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
         "span",
         {
@@ -43424,6 +43756,7 @@ function renderNode(node2, state, depth, index2) {
         },
         index2
       );
+    }
     case "table": {
       const align = node2.align ?? [];
       const rows = node2.children;
@@ -43489,11 +43822,15 @@ function renderMarkdown(body, options) {
     source = source.slice(0, maxBodyChars);
     bounded = true;
   }
-  const tree = fromMarkdown(source, {
-    extensions: [gfm()],
-    mdastExtensions: [gfmFromMarkdown()]
-  });
-  const state = { count: 0, bounded: false, options, maxNodes };
+  const tree = parseWithinLimits(source);
+  if (tree === null) {
+    return {
+      element: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("pre", { className: "doc-code doc-markdown-fallback", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: source }) }),
+      bounded: true,
+      limits: { maxBodyChars, maxNodes }
+    };
+  }
+  const state = { count: 0, bounded: false, insideLink: false, options, maxNodes, imageAssets: staticImageLookup(options) };
   const children = tree.children;
   const nodes = [];
   let i = 0;
@@ -43530,11 +43867,8 @@ function renderMarkdownToStaticHtml(body, options) {
   );
   return { html, bounded: rendered.bounded, limits: rendered.limits };
 }
-function renderDocumentToStaticHtml(document3, options = {}) {
-  const rendered = renderMarkdownToStaticHtml(document3.body, {
-    fromId: document3.id,
-    externalLinkHosts: options.externalLinkHosts
-  });
+function renderDocumentToStaticHtml(document3) {
+  const rendered = renderMarkdownToStaticHtml(document3.body, { fromId: document3.id });
   return { html: rendered.html, bounded: rendered.bounded };
 }
 
@@ -44432,6 +44766,17 @@ async function readInventory(backend, limits) {
   }
   return { documents, reserved, blobs };
 }
+function parseDocumentSource(bytes, id, okfEdition) {
+  try {
+    const raw = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return parseMarkdown(raw, `${id}.md`, { okfVersion: okfEdition });
+  } catch (error) {
+    throw new PublicationError("MALFORMED_DOCUMENT", "a publication document is malformed", {
+      subject: id,
+      cause: error
+    });
+  }
+}
 var SnapshotHandle = class {
   constructor(manifest, objects) {
     this.objects = objects;
@@ -44465,6 +44810,21 @@ var SnapshotHandle = class {
     }
     return bytes.slice();
   }
+  async renderDocument(id, options = {}) {
+    if (this.closed) throw new PublicationError("HANDLE_CLOSED", "the publication snapshot handle is closed");
+    const row = this.manifest.documents.find((document3) => document3.id === id);
+    if (!row) throw new PublicationError("OBJECT_MISSING", "the document is not part of this snapshot", { subject: id });
+    const parsed = parseDocumentSource(await this.readObject(row.source), id, this.manifest.source.okfEdition);
+    try {
+      const rendered = renderMarkdownToStaticHtml(parsed.body, { fromId: id, externalLinks: options.externalLinks });
+      return { html: rendered.html, bounded: rendered.bounded };
+    } catch (error) {
+      throw new PublicationError("RENDER_FAILED", "a publication document could not be rendered", {
+        subject: id,
+        cause: error
+      });
+    }
+  }
   serializeManifest() {
     if (this.closed) throw new PublicationError("HANDLE_CLOSED", "the publication snapshot handle is closed");
     return this.serializedManifest.slice();
@@ -44528,16 +44888,7 @@ function buildSnapshot(first) {
     }
   }
   for (const row of first.documents) {
-    let parsed;
-    try {
-      const raw = new TextDecoder("utf-8", { fatal: true }).decode(row.bytes);
-      parsed = parseMarkdown(raw, `${row.id}.md`, { okfVersion: okfEdition });
-    } catch (error) {
-      throw new PublicationError("MALFORMED_DOCUMENT", "a publication document is malformed", {
-        subject: row.id,
-        cause: error
-      });
-    }
+    const parsed = parseDocumentSource(row.bytes, row.id, okfEdition);
     if (typeof parsed.frontmatter.type !== "string" || !parsed.frontmatter.type.trim()) {
       throw new PublicationError("MALFORMED_DOCUMENT", "a publication document requires a non-empty type", {
         subject: row.id