0.1.1.md

[0.1.1] — 2026-04-18 · Stop 1 (PR #4, branch stop-1/safe-helpers-and-tests)

Infrastructure patch. Foundation for the v0.2 security track. No user-visible change.

Added

• src/render/safe.ts — single source of truth for every HTML/JS/JSON splice. Four helpers, one per context:
  • escHtml(s) — HTML text content
  • escAttr(s) — HTML attribute value (delegates to escHtml for now)
  • jsStr(s) — JS string-literal context, safe inside onclick='…'
  • safeJSON(v) — JSON embedding in <script>, escapes <, >, &, U+2028, U+2029
• tests/safe.test.ts — 22 tests for null/undefined collapse, character escapes, script-tag breakout, line-terminator handling, and a cross-helper invariant (no adversarial payload leaks a raw </script>).
• tsconfig.test.json + dist-test/ — isolated test compilation so the stdlib node:test runner can execute compiled test files.
• package.json scripts: typecheck (tsc --noEmit), test (compile tests then run node --test dist-test/tests/).
• README "Developing" section with the new script invocations.

Fixed

• jsStr — JSON.stringify leaves U+2028 / U+2029 raw, but the JS parser treats them as line terminators inside string literals, silently breaking the string. Added explicit \u2028 / \u2029 escapes. Caught by test 15 on the harness's first run.

Notes

• Zero new runtime dependencies. Zero new dev-dependencies — the test harness uses Node 18's built-in node:test module.