red_quilt 0.7.2 → 0.9.0

data/lib/red_quilt/inline/builder.rb

@@ -9,22 +9,10 @@ module RedQuilt
     #   1. linear_pass — code spans, brackets (link/image), autolinks,
     #      HTML, simple inlines. Emphasis delimiter runs are added as
     #      provisional TEXT nodes and pushed onto a delimiter stack.
-    #   2. process_emphasis — CommonMark spec 6.2 algorithm pairs up
-    #      delimiter stack entries into EMPHASIS / STRONG nodes.
+    #   2. EmphasisResolver#resolve — CommonMark spec 6.2 algorithm pairs
+    #      up delimiter stack entries into EMPHASIS / STRONG nodes
+    #      (delegated to Inline::EmphasisResolver).
     class Builder
-      SAFE_SCHEMES = %w[http https mailto ftp tel ssh].freeze
-      # Autolinks (`<scheme:...>`) are not run through the SAFE_SCHEMES
-      # allowlist: CommonMark permits arbitrary schemes there (e.g.
-      # `<made-up-scheme://x>`), and an allowlist would break that
-      # conformance. Only the schemes that execute script when the link
-      # is navigated are denied.
-      UNSAFE_AUTOLINK_SCHEMES = %w[javascript vbscript data].freeze
-
-      # `count` is the CommonMark delimiter-run length; a Delimiter is
-      # never enumerated, so shadowing Struct#count (from Enumerable) is
-      # intentional rather than a footgun.
-      Delimiter = Struct.new(:node_id, :char, :count, :can_open, :can_close) # rubocop:disable Lint/StructNewOverride
-
       Bracket = Struct.new(:token_id, :node_id, :image, :active, :delim_stack_size)
 
       # track_source: when true, arena nodes carry the byte ranges supplied
@@ -39,16 +27,17 @@ module RedQuilt
       def initialize(arena, source, references, track_source: true, diagnostics: nil, footnotes: nil)
         @arena = arena
         @source = source
-        # Binary view of the source for String#byteindex hot paths:
-        # byteindex on a UTF-8 string raises when the byte offset falls
-        # inside a multibyte sequence; the binary view treats every byte
-        # as its own character.
+        # Binary view of the source for String#index hot paths: on a
+        # UTF-8 string, index counts characters, so the offsets would not
+        # line up with our byte positions. The binary view treats every
+        # byte as its own character, making index a byte-offset search.
         @source_b = source.b
         @references = references
         @track_source = track_source
         @diagnostics = diagnostics
         @footnotes = footnotes
         @link_scanner = LinkScanner.new(source)
+        @emphasis = EmphasisResolver.new(arena, track_source: track_source)
       end
 
       def build(parent_id, tokens)
@@ -58,7 +47,7 @@ module RedQuilt
         @bracket_stack = []
         @provisional_nodes = {}
         linear_pass
-        process_emphasis(@delimiter_stack)
+        @emphasis.resolve(@delimiter_stack, @provisional_nodes)
       end
 
       private
@@ -228,43 +217,26 @@ module RedQuilt
         link_id = add_arena_node(
           NodeType::LINK,
           @tokens.start_byte(id), @tokens.end_byte(id),
-          str1: block_unsafe_autolink(@link_scanner.normalize_uri(destination)),
+          str1: UrlSanitizer.block_unsafe_autolink(@link_scanner.normalize_uri(destination), @diagnostics),
         )
         @arena.append_child(@parent_id, link_id)
         @arena.append_child(link_id, @arena.add_node(NodeType::TEXT, str1: label))
       end
 
-      # Returns "" (blocking the href) for autolink destinations whose
-      # scheme executes script on navigation; otherwise the destination
-      # is returned unchanged. Unlike sanitize_destination this is a
-      # denylist, to stay CommonMark-conformant for benign custom schemes.
-      def block_unsafe_autolink(destination)
-        scheme = destination[%r{\A([a-zA-Z][a-zA-Z0-9+\-.]*):}, 1]
-        return destination if scheme.nil?
-        return destination unless UNSAFE_AUTOLINK_SCHEMES.include?(scheme.downcase)
-
-        report_diagnostic(
-          severity: :warning,
-          rule: :unsafe_url,
-          message: "Unsafe URL scheme #{scheme.downcase.inspect} blocked",
-        )
-        ""
-      end
-
       # --------------------------- code spans -----------------------------
 
       # Find the closing backtick run for a code span by scanning the
       # source bytes directly. CommonMark: backslash escapes do not
       # apply inside a code span, so once we're past the opener every
       # backtick run is a real candidate (token-level ESCAPED_CHAR is
-      # ignored). byteindex jumps over non-backtick byte stretches at
-      # C speed.
+      # ignored). index on the binary view jumps over non-backtick byte
+      # stretches at C speed.
       def resolve_code_span(opener_id)
         run_len = @tokens.int1(opener_id)
         pos = @tokens.end_byte(opener_id)
         bytesize = @source_b.bytesize
         while pos < bytesize
-          run_start = @source_b.byteindex(BACKTICK_BYTE, pos)
+          run_start = @source_b.index(BACKTICK_BYTE, pos)
           break if run_start.nil?
 
           pos = run_start + 1
@@ -400,7 +372,7 @@ module RedQuilt
         link_kind = opener.image ? NodeType::IMAGE : NodeType::LINK
         link_id = add_arena_node(
           link_kind, opener_start, match[:end_byte],
-          str1: sanitize_destination(match[:destination]),
+          str1: UrlSanitizer.sanitize_destination(match[:destination], @diagnostics),
           str2: match[:title],
         )
 
@@ -416,7 +388,7 @@ module RedQuilt
         @arena.detach(opener.node_id)
 
         inner_delims = @delimiter_stack.slice!(opener.delim_stack_size..) || []
-        process_emphasis(inner_delims)
+        @emphasis.resolve(inner_delims, @provisional_nodes)
 
         @bracket_stack.delete_at(opener_index)
 
@@ -489,22 +461,6 @@ module RedQuilt
         last
       end
 
-      def sanitize_destination(destination)
-        return "" if destination.nil?
-        return destination if destination.start_with?("/", "#")
-
-        scheme = destination[%r{\A([a-zA-Z][a-zA-Z0-9+\-.]*):}, 1]
-        return destination if scheme.nil?
-        return destination if SAFE_SCHEMES.include?(scheme.downcase)
-
-        report_diagnostic(
-          severity: :warning,
-          rule: :unsafe_url,
-          message: "Unsafe URL scheme #{scheme.downcase.inspect} blocked",
-        )
-        ""
-      end
-
       def report_diagnostic(severity:, rule:, message:, source_span: nil)
         return unless @diagnostics
 
@@ -530,145 +486,12 @@ module RedQuilt
         @arena.append_child(@parent_id, node_id)
         @provisional_nodes[node_id] = true
 
-        @delimiter_stack << Delimiter.new(
+        @delimiter_stack << EmphasisResolver::Delimiter.new(
           node_id, char, count,
           (flags & 0b10) != 0,
           (flags & 0b01) != 0,
         )
       end
-
-      def process_emphasis(stack)
-        # NB: the CommonMark spec describes an `openers_bottom`
-        # optimization keyed by closer character / length / flanking
-        # flags. Implementing that correctly is subtle (a single
-        # per-character bottom blocks valid matches like
-        # `*foo**bar**baz*`), so the implementation here just walks
-        # back to the start of the stack for every closer. This is
-        # O(stack^2) in the worst case but stacks are tiny in practice.
-        closer_idx = 0
-
-        while closer_idx < stack.length
-          closer = stack[closer_idx]
-          unless closer.can_close
-            closer_idx += 1
-            next
-          end
-
-          opener_idx = closer_idx - 1
-          found = false
-          while opener_idx >= 0
-            opener = stack[opener_idx]
-            if opener.can_open && opener.char == closer.char
-              skip = false
-              if (opener.can_close || closer.can_open) &&
-                 ((opener.count + closer.count) % 3).zero? &&
-                 !((opener.count % 3).zero? && (closer.count % 3).zero?)
-                skip = true
-              end
-              unless skip
-                found = true
-                break
-              end
-            end
-            opener_idx -= 1
-          end
-
-          unless found
-            unless closer.can_open
-              @provisional_nodes.delete(closer.node_id)
-              stack.delete_at(closer_idx)
-            end
-            closer_idx += 1
-            next
-          end
-
-          opener = stack[opener_idx]
-          strength = [opener.count, closer.count].min >= 2 ? 2 : 1
-          if closer.char == "~"
-            # GFM strikethrough only forms on `~~` runs. A single `~`
-            # leaves the delimiter as text; advance the cursor so future
-            # `~~` pairs can still match.
-            if strength < 2
-              closer_idx += 1
-              next
-            end
-            kind = NodeType::STRIKETHROUGH
-          else
-            kind = strength == 2 ? NodeType::STRONG : NodeType::EMPHASIS
-          end
-
-          # CommonMark spec: any delimiters strictly between this opener and
-          # closer can't open or close anything in this scope, so drop them
-          # from the stack before we rebuild the tree. Their arena nodes
-          # stay where they are (they'll be reparented into the new emphasis
-          # alongside the surrounding content), but they must no longer be
-          # candidates for future iterations. Without this, the next
-          # iteration would try to pair stranded delimiters that have
-          # already been moved into a different parent, which corrupts the
-          # sibling chain (Arena#reparent walks into @parent[-1]).
-          if closer_idx > opener_idx + 1
-            removed = stack.slice!((opener_idx + 1)...closer_idx)
-            removed.each { |e| @provisional_nodes.delete(e.node_id) }
-            closer_idx = opener_idx + 1
-            closer = stack[closer_idx]
-          end
-
-          opener_node = opener.node_id
-          closer_node = closer.node_id
-
-          if @track_source
-            opener_match_start = @arena.source_end(opener_node) - strength
-            closer_match_end = @arena.source_start(closer_node) + strength
-          else
-            opener_match_start = -1
-            closer_match_end = 0
-          end
-          emphasis_id = add_arena_node(kind, opener_match_start, closer_match_end)
-
-          first_inside = @arena.raw_next_sibling_id(opener_node)
-          last_inside = @arena.raw_prev_sibling_id(closer_node)
-          if first_inside != -1 && last_inside != -1 &&
-             first_inside != closer_node && last_inside != opener_node
-            @arena.reparent(emphasis_id, first_inside, last_inside)
-          end
-
-          parent_id = @arena.raw_parent_id(opener_node)
-          @arena.insert_before(parent_id, closer_node, emphasis_id)
-
-          if opener.count == strength
-            @provisional_nodes.delete(opener_node)
-            @arena.detach(opener_node)
-            stack.delete_at(opener_idx)
-            closer_idx -= 1
-          else
-            opener.count -= strength
-            str = @arena.str1(opener_node)
-            @arena.update_str1(opener_node, str[0...-strength])
-            if @track_source
-              new_end = @arena.source_end(opener_node) - strength
-              @arena.update_span(opener_node, @arena.source_start(opener_node), new_end)
-            end
-          end
-
-          if closer.count == strength
-            @provisional_nodes.delete(closer_node)
-            @arena.detach(closer_node)
-            stack.delete_at(closer_idx)
-          else
-            closer.count -= strength
-            str = @arena.str1(closer_node)
-            @arena.update_str1(closer_node, str[strength..])
-            if @track_source
-              new_start = @arena.source_start(closer_node) + strength
-              new_end = @arena.source_end(closer_node)
-              @arena.update_span(closer_node, new_start, new_end)
-            end
-          end
-        end
-
-        stack.each { |e| @provisional_nodes.delete(e.node_id) }
-        stack.clear
-      end
     end
   end
 end

data/lib/red_quilt/inline/emphasis_resolver.rb

@@ -0,0 +1,184 @@
+# frozen_string_literal: true
+
+module RedQuilt
+  module Inline
+    # CommonMark emphasis algorithm (spec 6.2). Phase 2 of inline parsing:
+    # given the delimiter stack the linear pass collected (provisional TEXT
+    # nodes for each `*` / `_` / `~` run), it pairs openers with closers and
+    # rebuilds the arena subtree into EMPHASIS / STRONG / STRIKETHROUGH
+    # nodes.
+    #
+    # Kept separate from Builder because it is a closed algorithm with a
+    # narrow interface: it only needs the arena, the set of still-provisional
+    # nodes (so consumed delimiters can be unmarked), and whether source
+    # spans are tracked. Builder owns the linear pass and bracket handling;
+    # it hands this resolver a delimiter stack to collapse.
+    class EmphasisResolver
+      # `count` is the CommonMark delimiter-run length; a Delimiter is
+      # never enumerated, so shadowing Struct#count (from Enumerable) is
+      # intentional rather than a footgun.
+      Delimiter = Struct.new(:node_id, :char, :count, :can_open, :can_close) # rubocop:disable Lint/StructNewOverride
+
+      def initialize(arena, track_source:)
+        @arena = arena
+        @track_source = track_source
+      end
+
+      # Collapses `stack` (an Array of Delimiter) in place, removing
+      # consumed entries from `provisional_nodes`. Used both for the
+      # document-level stack and for the inner delimiters of a resolved
+      # link/image (see Builder#finalize_link).
+      def resolve(stack, provisional_nodes)
+        # NB: the CommonMark spec describes an `openers_bottom`
+        # optimization keyed by closer character / length / flanking
+        # flags. Implementing that correctly is subtle (a single
+        # per-character bottom blocks valid matches like
+        # `*foo**bar**baz*`), so the implementation here just walks
+        # back to the start of the stack for every closer. This is
+        # O(stack^2) in the worst case but stacks are tiny in practice.
+        closer_idx = 0
+
+        while closer_idx < stack.length
+          closer = stack[closer_idx]
+          unless closer.can_close
+            closer_idx += 1
+            next
+          end
+
+          opener_idx = closer_idx - 1
+          found = false
+          while opener_idx >= 0
+            opener = stack[opener_idx]
+            if opener.can_open && opener.char == closer.char
+              skip = false
+              if (opener.can_close || closer.can_open) &&
+                 ((opener.count + closer.count) % 3).zero? &&
+                 !((opener.count % 3).zero? && (closer.count % 3).zero?)
+                skip = true
+              end
+              unless skip
+                found = true
+                break
+              end
+            end
+            opener_idx -= 1
+          end
+
+          unless found
+            unless closer.can_open
+              provisional_nodes.delete(closer.node_id)
+              stack.delete_at(closer_idx)
+            end
+            closer_idx += 1
+            next
+          end
+
+          opener = stack[opener_idx]
+          strength = [opener.count, closer.count].min >= 2 ? 2 : 1
+          if closer.char == "~"
+            # GFM strikethrough only forms on `~~` runs. A single `~`
+            # leaves the delimiter as text; advance the cursor so future
+            # `~~` pairs can still match.
+            if strength < 2
+              closer_idx += 1
+              next
+            end
+            kind = NodeType::STRIKETHROUGH
+          else
+            kind = strength == 2 ? NodeType::STRONG : NodeType::EMPHASIS
+          end
+
+          # CommonMark spec: any delimiters strictly between this opener and
+          # closer can't open or close anything in this scope, so drop them
+          # from the stack before we rebuild the tree. Their arena nodes
+          # stay where they are (they'll be reparented into the new emphasis
+          # alongside the surrounding content), but they must no longer be
+          # candidates for future iterations. Without this, the next
+          # iteration would try to pair stranded delimiters that have
+          # already been moved into a different parent, which corrupts the
+          # sibling chain (Arena#reparent walks into @parent[-1]).
+          if closer_idx > opener_idx + 1
+            removed = stack.slice!((opener_idx + 1)...closer_idx)
+            removed.each { |e| provisional_nodes.delete(e.node_id) }
+            closer_idx = opener_idx + 1
+            closer = stack[closer_idx]
+          end
+
+          opener_node = opener.node_id
+          closer_node = closer.node_id
+
+          if @track_source
+            opener_match_start = @arena.source_end(opener_node) - strength
+            closer_match_end = @arena.source_start(closer_node) + strength
+          else
+            opener_match_start = -1
+            closer_match_end = 0
+          end
+          emphasis_id = add_node(kind, opener_match_start, closer_match_end)
+
+          first_inside = @arena.raw_next_sibling_id(opener_node)
+          last_inside = @arena.raw_prev_sibling_id(closer_node)
+          if first_inside != -1 && last_inside != -1 &&
+             first_inside != closer_node && last_inside != opener_node
+            @arena.reparent(emphasis_id, first_inside, last_inside)
+          end
+
+          parent_id = @arena.raw_parent_id(opener_node)
+          @arena.insert_before(parent_id, closer_node, emphasis_id)
+
+          # Consume `strength` characters from the inner end of each
+          # delimiter. The opener is trimmed on its right (trailing) end,
+          # the closer on its left (leading) end; removing the opener from
+          # the stack shifts the closer one slot left.
+          closer_idx -= 1 if consume_delimiter(opener, opener_idx, stack, strength, provisional_nodes, from_start: false)
+          consume_delimiter(closer, closer_idx, stack, strength, provisional_nodes, from_start: true)
+        end
+
+        stack.each { |e| provisional_nodes.delete(e.node_id) }
+        stack.clear
+      end
+
+      private
+
+      # Mirrors Builder#add_arena_node for the nodes this resolver creates
+      # (emphasis wrappers only ever take a type and a span).
+      def add_node(type, start_byte, end_byte)
+        if @track_source
+          @arena.add_node(type, source_start: start_byte, source_len: end_byte - start_byte)
+        else
+          @arena.add_node(type, source_start: -1, source_len: 0)
+        end
+      end
+
+      # Removes `strength` characters from one end of a delimiter run. When
+      # the whole run is consumed the node is detached and dropped from the
+      # stack (returns true); otherwise its count, str1, and — in
+      # source-tracking mode — its span are trimmed on the requested side
+      # (`from_start` trims the leading end, used for closers; trailing for
+      # openers) and it stays on the stack (returns false).
+      def consume_delimiter(entry, index, stack, strength, provisional_nodes, from_start:)
+        node = entry.node_id
+        if entry.count == strength
+          provisional_nodes.delete(node)
+          @arena.detach(node)
+          stack.delete_at(index)
+          return true
+        end
+
+        entry.count -= strength
+        str = @arena.str1(node)
+        @arena.update_str1(node, from_start ? str[strength..] : str[0...-strength])
+        if @track_source
+          start_byte = @arena.source_start(node)
+          end_byte = @arena.source_end(node)
+          if from_start
+            @arena.update_span(node, start_byte + strength, end_byte)
+          else
+            @arena.update_span(node, start_byte, end_byte - strength)
+          end
+        end
+        false
+      end
+    end
+  end
+end

data/lib/red_quilt/inline/lexer.rb

@@ -22,8 +22,8 @@ module RedQuilt
         [0x2A, 0x5F, 0x60, 0x5B, 0x5D, 0x21, 0x3C, 0x26, 0x5C, 0x0A, 0x7E].each { |b| a[b] = true }
         a.freeze
       end
-      # Same set as SPECIAL_BYTES, for String#byteindex to jump over long
-      # plain-text runs at C speed.
+      # Same set as SPECIAL_BYTES, for String#index on the binary view to
+      # jump over long plain-text runs at C speed.
       SPECIAL_BYTE_RE = /[*_`\[\]!<&\\\n~]/
 
       # Anchored regexes for StringScanner#scan (still used by
@@ -116,12 +116,12 @@ module RedQuilt
             pos = @ss.pos
           else
             # Inlined scan_text. Always make progress: consume the
-            # current byte, then byteindex against the binary view to
+            # current byte, then index against the binary view to
             # leap to the next special byte at C speed.
             start = pos
             pos += 1
             if pos < end_pos
-              next_special = @source_b.byteindex(SPECIAL_BYTE_RE, pos)
+              next_special = @source_b.index(SPECIAL_BYTE_RE, pos)
               pos = next_special.nil? || next_special >= end_pos ? end_pos : next_special
             end
             tokens.emit(TokenKind::TEXT, start_byte: start, end_byte: pos)

data/lib/red_quilt/inline/url_sanitizer.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module RedQuilt
+  module Inline
+    # URL-scheme security policy for inline link / image / autolink
+    # destinations. Kept separate from Builder so the "which schemes are
+    # safe and how blocking is reported" concern has a single home and can
+    # change without touching the inline construction logic.
+    #
+    # Stateless (module_function); diagnostics are appended to the caller's
+    # array (or skipped when it is nil), so there is no per-call allocation.
+    module UrlSanitizer
+      module_function
+
+      SAFE_SCHEMES = %w[http https mailto ftp tel ssh].freeze
+
+      # Autolinks (`<scheme:...>`) are not run through the SAFE_SCHEMES
+      # allowlist: CommonMark permits arbitrary schemes there (e.g.
+      # `<made-up-scheme://x>`), and an allowlist would break that
+      # conformance. Only the schemes that execute script when the link
+      # is navigated are denied.
+      UNSAFE_AUTOLINK_SCHEMES = %w[javascript vbscript data].freeze
+
+      SCHEME_RE = /\A([a-zA-Z][a-zA-Z0-9+\-.]*):/
+
+      # Link / image destinations: allowlist. Relative URLs (starting `/`
+      # or `#`) and scheme-less URLs pass; an unknown scheme is blocked
+      # (href emptied) and a diagnostic is recorded.
+      def sanitize_destination(destination, diagnostics)
+        return "" if destination.nil?
+        return destination if destination.start_with?("/", "#")
+
+        scheme = destination[SCHEME_RE, 1]
+        return destination if scheme.nil?
+        return destination if SAFE_SCHEMES.include?(scheme.downcase)
+
+        report_blocked(diagnostics, scheme)
+        ""
+      end
+
+      # Autolink destinations: denylist. The destination is returned
+      # unchanged unless its scheme executes script on navigation, in which
+      # case the href is emptied and a diagnostic is recorded.
+      def block_unsafe_autolink(destination, diagnostics)
+        scheme = destination[SCHEME_RE, 1]
+        return destination if scheme.nil?
+        return destination unless UNSAFE_AUTOLINK_SCHEMES.include?(scheme.downcase)
+
+        report_blocked(diagnostics, scheme)
+        ""
+      end
+
+      def report_blocked(diagnostics, scheme)
+        return unless diagnostics
+
+        diagnostics << Diagnostic.new(
+          severity: :warning,
+          rule: :unsafe_url,
+          message: "Unsafe URL scheme #{scheme.downcase.inspect} blocked",
+        )
+      end
+    end
+  end
+end

data/lib/red_quilt/inline_pass.rb

@@ -35,8 +35,7 @@ module RedQuilt
                               diagnostics: @document.diagnostics,
                               footnotes: @document.footnotes).build(node_id, @tokens)
         else
-          start_byte = @arena.source_start(node_id)
-          end_byte = @arena.source_end(node_id)
+          start_byte, end_byte = inline_range(node_id)
           @lexer.lex_into(@tokens, start_byte, end_byte)
           @builder.build(node_id, @tokens)
         end
@@ -49,5 +48,19 @@ module RedQuilt
         child_id = @arena.raw_next_sibling_id(child_id)
       end
     end
+
+    # The byte range to lex as inline content. For most nodes that is the
+    # source span, but an ATX heading's span covers the `#` marker and any
+    # closing hashes so that positions point at the heading as authored;
+    # lexing that range would turn the marker into text. Setext headings
+    # leave the content range zeroed and fall back to the span.
+    def inline_range(node_id)
+      if @arena.type(node_id) == NodeType::HEADING && @arena.heading_content_start(node_id).positive?
+        start_byte = @arena.heading_content_start(node_id)
+        return [start_byte, start_byte + @arena.heading_content_len(node_id)]
+      end
+
+      [@arena.source_start(node_id), @arena.source_end(node_id)]
+    end
   end
 end

data/lib/red_quilt/line.rb

@@ -10,5 +10,10 @@ module RedQuilt
   # Positional (not keyword_init): one Line is built per source line, so
   # the ~2.5x faster positional constructor matters on large documents.
   # Argument order: content, start_byte, end_byte, blank, lazy_continuation.
-  Line = Struct.new(:content, :start_byte, :end_byte, :blank, :lazy_continuation)
+  Line = Struct.new(:content, :start_byte, :end_byte, :blank, :lazy_continuation) do
+    # Byte length of the line's span in the original source.
+    def span_len
+      end_byte - start_byte
+    end
+  end
 end

data/lib/red_quilt/lint_pass.rb

@@ -22,7 +22,7 @@ module RedQuilt
       walk(@document.root_id) do |id|
         case @arena.type(id)
         when NodeType::HEADING
-          level = @arena.int1(id)
+          level = @arena.heading_level(id)
           if last_heading_level.positive? && level > last_heading_level + 1
             push(:info, :heading_level_skip,
                  "Heading jumps from h#{last_heading_level} to h#{level}",
@@ -45,7 +45,7 @@ module RedQuilt
     end
 
     def check_empty_link(node_id)
-      return unless @arena.str1(node_id).to_s.empty?
+      return unless @arena.link_destination(node_id).to_s.empty?
 
       push(:warning, :empty_link,
            "Link has no destination",

data/lib/red_quilt/list.rb

@@ -146,15 +146,19 @@ module RedQuilt
 
       def parse(parent_id, lines, index)
         first_match = List.match(lines[index].content)
+        # Leading indent is excluded, so `  - item` starts at the bullet.
+        list_start_byte = lines[index].start_byte + Indentation.leading_ws_bytes(lines[index].content)
         list_id = @arena.add_node(NodeType::LIST,
-                                  source_start: lines[index].start_byte,
+                                  source_start: list_start_byte,
                                   source_len: 0,
                                   int1: first_match[:ordered] ? 1 : 0,
                                   int2: first_match[:start_number],
                                   int3: 1,
                                   str1: first_match[:marker])
         @arena.append_child(parent_id, list_id)
-        start_byte = lines[index].start_byte
+        # update_span below rewrites the span once the list's extent is
+        # known, so it has to carry the indent-stripped start too.
+        start_byte = list_start_byte
         end_byte = lines[index].end_byte
         loose = false
 
@@ -167,11 +171,16 @@ module RedQuilt
           break unless match
           break unless List.same_group?(first_match, match)
 
+          # collect_item strips the bullet, so item_lines start at the item's
+          # content. The span starts at the marker instead — an item is
+          # authored as "- text", not "text".
+          marker_line = lines[index]
+          item_start = marker_line.start_byte + Indentation.leading_ws_bytes(marker_line.content)
           item_lines, index = collect_item(lines, index, match)
           end_byte = item_lines.last.end_byte
           item_id = @arena.add_node(NodeType::LIST_ITEM,
-                                    source_start: item_lines.first.start_byte,
-                                    source_len: item_lines.last.end_byte - item_lines.first.start_byte)
+                                    source_start: item_start,
+                                    source_len: item_lines.last.end_byte - item_start)
           @arena.append_child(list_id, item_id)
           # CommonMark: an item is loose when "two block-level elements
           # with a blank line between them" appear at its top level.