v0.27.0 — External data & hosted content

The tier-1 spine of SPEC-103: a preprocess-time data rune that reads a sandboxed external file and emits a Markdoc table AST node, the CSV/TSV adapter, and the shared projection + typing core (incl. data-value emission) and table emitter that every adapter reuses. JSON/NDJSON adapters (WORK-486), the datatable sort change (WORK-487), SQLite, and remote sources are out of scope. Proves the headline claim — chart and datatable consume the emitted <table> with no structural edits.

The foundation of SPEC-113: one synchronous ProjectFiles interface in @refrakt-md/types, with filesystem and in-memory providers, that replaces the four ad-hoc fs seams. Containment becomes an interface contract, so no consumer re-implements path-safety. Also lands the recordable-read wrapper that ADR-025 names as the one piece of groundwork for future incremental rebuild.

Move the sandbox example read seam (__sandboxReadFile family + preprocess sandbox hooks) onto the WORK-481 ProjectFiles provider, and route the sandbox src directory join through it so it inherits containment — closing the unguarded examplesDir + '/' + src path-traversal gap.

Close the main gap in SPEC-113: read-file.ts (and the snippet/expand/file-ref pipelines) call node:fs directly today, bypassing the injectable seam — so tree mode is not actually fs-free for snippets. Delegate the I/O to the WORK-481 provider, keeping line-slicing and diagnostics intact.

Finish the consumer migration and the virtual entry point: scan fileRoots and the plan plugin's configure scan through the provider, expose projectFiles + gitTimestamps on loadContentFromTree, and prove a full site builds from a pure in-memory map.

Document the ProjectFiles contract and the fetch-then-build materialization pattern for remote hosts, so plugin and adapter authors know the seam and how a hosted renderer feeds it.

The JSON-family adapters for SPEC-103, on top of the WORK-417 adapter contract + projection core. JSON is not inherently tabular, so its adapter owns the three knobs CSV doesn't; NDJSON is line-delimited records. Both reduce to the shared { headers, rows } shape and are indistinguishable downstream.

The one host-side change SPEC-103 takes for typing: extend the datatable sort comparator to prefer a cell's data-value over its textContent, mirroring what chart already does (cell.dataset.value ?? textContent). This is what lets data's numeric typing produce correct sorts of human-formatted numbers (currency, thousands separators, units) — and it equally fixes hand-authored tables, so it is a general improvement, not a data-specific hack.

The author-facing documentation for SPEC-103: the data rune with CSV + JSON examples, the chart/datatable composition story, and the build-time-vs-runtime distinction so authors reach for the right layer.