[onmax]

Stacked on #99.

comark-charts lays out eight chart types itself. For any other chart, such as a box plot, a heatmap, or error bands, you can now put a Vega-Lite spec after the table in a vega-lite block:

::chart{title="Latency per request (ms)"}
| endpoint | ms |
| --- | --: |
| /search | 120 |
| /login | 40 |

```vega-lite
{ "mark": "boxplot", "encoding": { "x": { "field": "endpoint", "type": "nominal" }, "y": { "field": "ms", "type": "quantitative" } } }
```
::

The table is still the data, so it stays in the page under Data and agents read the numbers as before. Each row becomes one data point, with numbers parsed like the other charts' cells. The spec is drawn while parsing, like the other charts (#99), so it works in every renderer.

• The chart takes the house colors and type wherever the spec sets none, so the stylesheet's dark-mode swaps still apply. The spec's own config wins.
• Issues: a spec that isn't JSON or isn't an object, data in the spec (the table replaces it), a field that's neither a header nor made by a transform (as, or a fold's key/value), props such as type, x, or y that don't apply, annotations (marks need comark-charts' layout), and anything Vega can't draw. The chart then shows its table.
• Documents are untrusted, so the spec can't load anything: the Vega loader refuses every file and URL, and links are stripped from the SVG.

Tests: test/spec.test.ts covers drawing, each issue, transform fields, a failed draw, and a spec that tries to load URLs or add a javascript: link.

[vitehub-bot]

Session	Status	Started	Duration
Pending	Completed	Not started	—
View session	Completed	2026-10-22T14:31:50.703Z	3m 57s

Latest result

Pull request merged.

Final answers

Session

Pull request merged.

Session

Waiting for GitHub merge request 766fa415-532d-4ef9-8382-ed14f0fd228b.

View session

Verified HEAD and current checks: all required checks pass, and Pullfrog’s lookup and nested-data findings are addressed and resolved. No actionable P0/P1 findings remain; historical feedback is either fixed or resolved. Focused local tests were unavailable because workspace build artifacts are absent and pnpm’s prepare step cannot write protected Git metadata; hosted checks remain green.

Session

Fixed the Doctor failure and Pullfrog P1 lookup-data finding. Nested data is removed safely, lookup transforms with secondary data are rejected clearly, and the review thread is resolved. Charts Doctor passes with zero warnings; focused tests could not run because workspace build artifacts are absent. Awaiting current-head checks.

Session

Fixed the Doctor failure and Pullfrog P1 lookup-data finding. Nested data is removed safely, lookup transforms with secondary data are rejected clearly, and the review thread is resolved. Charts Doctor passes with zero warnings; focused tests could not run because workspace build artifacts are absent. Awaiting current-head checks.

Session

Fixed the Doctor failure and Pullfrog P1 lookup-data finding. Nested data is removed safely, lookup transforms with secondary data are rejected clearly, and the review thread is resolved. Charts Doctor passes with zero warnings; focused tests could not run because workspace build artifacts are absent. Awaiting current-head checks.

Session

Fixed the Doctor failure and Pullfrog P1 lookup-data finding. Nested data is removed safely, lookup transforms with secondary data are rejected clearly, and the review thread is resolved. Charts Doctor passes with zero warnings; focused tests could not run because workspace build artifacts are absent. Awaiting current-head checks.

Session

Fixed the Doctor failure and Pullfrog P1 lookup-data finding. Nested data is removed safely, lookup transforms with secondary data are rejected clearly, and the review thread is resolved. Charts Doctor passes with zero warnings; focused tests could not run because workspace build artifacts are absent. Awaiting current-head checks.

Session

Fixed the Doctor failure and Pullfrog P1 lookup-data finding. Nested data is removed safely, lookup transforms with secondary data are rejected clearly, and the review thread is resolved. Charts Doctor passes with zero warnings; focused tests could not run because workspace build artifacts are absent. Awaiting current-head checks.

Session

Fixed the Doctor failure and Pullfrog P1 lookup-data finding. Nested data is removed safely, lookup transforms with secondary data are rejected clearly, and the review thread is resolved. Charts Doctor passes with zero warnings; focused tests could not run because workspace build artifacts are absent. Awaiting current-head checks.

[pkg-pr-new]

Open in StackBlitz

comark-annotate

pnpm add https://pkg.pr.new/comark-annotate@101

comark-carousel

pnpm add https://pkg.pr.new/comark-carousel@101

comark-charts

pnpm add https://pkg.pr.new/comark-charts@101

comark-chips

pnpm add https://pkg.pr.new/comark-chips@101

comark-code

pnpm add https://pkg.pr.new/comark-code@101

comark-diff

pnpm add https://pkg.pr.new/comark-diff@101

comark-embed

pnpm add https://pkg.pr.new/comark-embed@101

comark-github

pnpm add https://pkg.pr.new/comark-github@101

comark-icon

pnpm add https://pkg.pr.new/comark-icon@101

comark-include

pnpm add https://pkg.pr.new/comark-include@101

comark-linter

pnpm add https://pkg.pr.new/comark-linter@101

comark-tabs

pnpm add https://pkg.pr.new/comark-tabs@101

comark-zoom

pnpm add https://pkg.pr.new/comark-zoom@101

commit: d354a37

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	d354a37	2026-10-22T14:19:19.299Z	Visit the dashboard ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	0ee535d	2026-10-22T13:44:02.140Z	Visit the dashboard ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	308aaea	2026-10-22T13:22:06.911Z	Visit the dashboard ↗

[pullfrog]

Important

The table-only data contract is not enforced for composed Vega-Lite specs.

Reviewed changes

This review covers the new Vega-Lite parsing, validation, server-side SVG rendering, renderer integration, documentation, and tests.

• Vega-Lite table charts — accepts a fenced vega-lite spec, converts table rows to values, compiles it during parsing, and preserves the table as rendered data.
• Validation and safety — reports invalid JSON, unsupported chart props, missing fields, and root-level data; seals resource loading and strips SVG links.
• Rendering and docs — applies house defaults, exposes the new chart type through renderers, and documents the syntax and limitations.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}

[pullfrog]

Important

The recursive table-data sanitization now breaks valid Vega-Lite lookup transforms by deleting their required secondary data source.

Reviewed changes

This review covers the nested-data sanitization and regression test added since the prior Pullfrog review.

• Sanitized composed views — recursively removes nested data declarations before injecting the Markdown table as the root source.
• Expanded safety coverage — verifies that nested inline rows and external resources cannot appear in the rendered SVG.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

This incremental review covers the lookup-source safety fix added since the prior Pullfrog review.

• Rejected lookup data sources — detected Vega-Lite lookup transforms with from.data before recursive sanitization, so unsupported secondary sources now produce an issue and table-only fallback instead of being silently corrupted.
• Retained table-only composition handling — preserved recursive removal of nested view data declarations and root injection of the Markdown table, with the existing sealed loader and SVG link stripping.

  ^{｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}