@ai-react-markdown/engine 2.5.4 → 2.6.0

package/dist/index.d.cts

@@ -316,202 +316,15 @@ interface FreezeScanResult {
      *  re-lexing the confirmed prefix. Single-consumer; see module docs. */
     checkpoint: FreezeScanCheckpoint;
 }
-interface Candidate {
-    /** Freeze boundary: start of the line after this blank line. */
-    offset: number;
-    /** Consecutive confirmed blank lines (outside fences/math) ending here. */
-    blankRun: number;
-    /** No unbalanced HTML container / comment / raw block before this point. */
-    htmlBalanced: boolean;
-    /** Rolling continuation-hazard verdict at emission (blocker 3). */
-    hazard: boolean;
-    /** Blocker-6: the run ending at this blank left balanced FLOATING raw
-     *  remnant whose hast seam is tail-dependent; reject this candidate. */
-    seamRisk: boolean;
-    /** Blocker-4 settle verdict, decided by the NEXT confirmed line (`null`
-     *  while that line hasn't confirmed — only the newest candidate can be
-     *  pending). Storing the verdict instead of the line lets the checkpoint
-     *  drop its lines array, which retained a full copy of the document
-     *  (round-2 review: ~2-3× doc size per mounted instance). */
-    defListSettled: boolean | null;
-}
-interface UnresolvedRef {
-    offset: number;
-    label: string;
-    footnote: boolean;
-}
-/** Mutable resume state. All fields describe the scan strictly BEFORE the
- *  first unconfirmed character (`confirmedOffset`). */
+/** Opaque resume token. Produced by one `computeFreezeBoundary` call and
+ *  passed back on the next APPEND-ONLY call; the only supported operations
+ *  are storing it and passing it back. The field set is an implementation
+ *  detail of the scanner and changes between minor versions — the brand key
+ *  (a structural string literal, safe across dual d.ts entries) is all that
+ *  ships in the public type. */
 interface FreezeScanCheckpoint {
-    defListEnabled: boolean;
-    /** Grammar-profile switches baked at creation — a checkpoint is only
-     *  resumable under the exact profile that built it. */
-    mathFlow: boolean;
-    referenceTaint: boolean;
-    /** Start offset of the first line NOT yet baked into this checkpoint. */
-    confirmedOffset: number;
-    candidates: Candidate[];
-    defs: Map<string, number>;
-    footnoteDefs: Map<string, number>;
-    unresolvedRefs: UnresolvedRef[];
-    tagBalance: Map<string, number>;
-    openTotal: number;
-    commentOpen: boolean;
-    piOpen: boolean;
-    declOpen: boolean;
-    cdataOpen: boolean;
-    /** parse5 BOGUS COMMENT open inside a real html-flow run: `<!` not
-     *  followed by `--` / letter / `[CDATA[`, or `</` not followed by a
-     *  letter (`<!\n`, `<!-`, `</\n`, `<//`) — eaten up to the next `>`;
-     *  a `</div>` inside is comment text, not a close (2026-08-19 review r2
-     *  P1-3: the balance zeroed past an open div). micromark has no such
-     *  construct: those bytes are just html-block content. */
-    bogusOpen: boolean;
-    /** The RAW_TEXT_ELEMENTS element currently open (its content is text to
-     *  parse5): tags and comment tokens are ignored until `</name>`. */
-    rawTextOpen: string | null;
-    inFence: boolean;
-    fenceChar: string;
-    fenceLen: number;
-    inMath: boolean;
-    /** Opening dollar-run length while inMath — the close run must match it. */
-    mathFenceLen: number;
-    /** Indent (0-3 spaces) of the line that opened the current fence/math
-     *  block. Not a blocker input — read by `phantomSuffixCloser` to emit a
-     *  closer at the SAME indent, which closes the block whether it sits at
-     *  top level (≤3 spaces are allowed there) or inside a list item whose
-     *  content indent the opener line already satisfies. */
-    openIndent: number;
-    blankRun: number;
-    lastBlankStart: number;
-    /** Rolling blocker-3 verdict ("nearest decisive block start so far"). */
-    hazardVerdict: boolean;
-    /** Previous confirmed line was blank (block-start detection). */
-    prevLineBlank: boolean;
-    /** Previous confirmed line was a plain text line (def-chain detection). */
-    prevLineWasText: boolean;
-    /** Previous confirmed line registered a VALID definition (def chains). */
-    prevLineWasValidDef: boolean;
-    /** An earlier line of the current paragraph left an unpaired backtick
-     *  run — masking is disabled until the paragraph ends (safety gate). */
-    /** A `[` left unclosed at the end of a paragraph line (code spans
-     *  masked). micromark lets a reference label span soft line breaks, so
-     *  the label may close on a LATER line where the per-line REF_RE never
-     *  sees a `[…]` pair (v2.4.1 review P1: `see [foo\nbar] end` + a late
-     *  `[foo bar]: /u` retargeted frozen output). Cleared wherever the
-     *  paragraph ends. */
-    openBracket: {
-        offset: number;
-        text: string;
-    } | null;
-    paragraphHasUnpairedRun: boolean;
-    /** Blocker-6 pending flag: a confirmed html-flow line left balanced
-     *  floating raw remnant, and no later content line has pinned the seam
-     *  yet. Persists across blank lines (every candidate emitted while set
-     *  has the remnant as its last frozen child); cleared by the next
-     *  non-blank line that starts OUTSIDE an html-flow run. */
-    htmlSeamPending: boolean;
-    /** A line since the last blank started with `<` at block indent — an html
-     *  FLOW block is (approximately) running, and it only ends at a blank
-     *  line. micromark does no inline parsing there: backtick runs are
-     *  literal text, so code-span masking would hide REAL tags from the
-     *  balance scan (under-block — fuzz counterexample: `</details>` followed
-     *  by an unblanked `` `<div>` `` line). While set, masking is skipped —
-     *  which can only over-block (safe direction). */
-    htmlFlowSinceBlank: boolean;
-    /** Offset of the first fence/math OPEN suppressed by `htmlFlowSinceBlank`
-     *  (Infinity = none). Whether the run really swallowed that line depends
-     *  on container context the line scan cannot see (`<embed` inside a list
-     *  item is a lazy paragraph line, and the glued `$$` a REAL math open —
-     *  seed-20260757 under-block: the tracker's fence phase INVERTS from that
-     *  line on, every later close reads as an open, and the corruption never
-     *  resyncs). Candidates past this offset are rejected outright — sticky,
-     *  pure over-block; candidates before it are untouched (the ambiguous
-     *  region then re-parses inside the tail). The rolling hazard poison for
-     *  ambiguous tag names stays, but it decays at the next decisive block
-     *  start — this field is the phase-corruption backstop that does not. */
-    phasePoisonedAt: number;
-    /** Tag names of line-truncated opens (`<div` at EOL) counted into
-     *  tagBalance but not yet confirmed by a later `>` — reverted at the next
-     *  blank line (a tag cannot span one). See TRUNCATED_TAG_RE. */
-    pendingTruncatedTags: string[];
-    /** Line-truncated CLOSING tags (`</div` + EOL, no `>`) inside an html-flow
-     *  run, waiting for a `>` on a later line of the same run. Unlike opens
-     *  they are NOT counted up front: a close tag cannot carry attributes, so
-     *  `para </style` (prose to micromark, still-open element to parse5 —
-     *  RAWTEXT waits for the `>`) must not zero the balance (2026-08-19
-     *  review P1 — the boundary crossed an open `<style>`). Confirmed and
-     *  applied only when a later line of the run brings the `>` (parse5
-     *  completes the end tag; micromark's block ends at the blank anyway);
-     *  dropped unapplied at the blank (element stays counted — over-block).
-     *  Paragraph-context truncated closes are never pended: a `>` at block
-     *  indent on the next line is a blockquote to micromark, and the one
-     *  shape that would complete the inline close (`</b\n    >`, a 4+-space
-     *  lazy continuation) is not modelled — the element stays counted,
-     *  over-block. */
-    pendingTruncatedCloses: string[];
-    /** An html-flow line ended inside a tag (`<div`, `</div`, `<br` — open,
-     *  close or void, with or without attributes): parse5's tokenizer is
-     *  still in that tag, so on the following lines everything up to the
-     *  FIRST `>` is attribute garbage — `</div>` there does NOT close
-     *  anything (oracle review of 2.4.4: `<div>\n<div>\n</div\n</div>` froze
-     *  past the still-open outer div; pre-existing, 1-char slices). While
-     *  set: a line without `>` gets no tag scan at all; the line with the
-     *  `>` completes the pending close (if any), then only its text after
-     *  that `>` is scanned. Cleared there and at the blank line. */
-    tagAcrossLines: boolean;
-    /** Indent of the line that set `tagAcrossLines`. A following line that
-     *  DE-INDENTS below it may have left the container (a list item's html
-     *  block ends there; hast-util-raw resets the tokenizer at the li/ul
-     *  boundary, so a `<div>` on that line is a real start tag, not garbage)
-     *  — or may still be the same html block (root-level `  </div\n</div>`,
-     *  still garbage). Unknowable here → poison (oracle 3rd pass). */
-    tagAcrossLinesIndent: number;
-    /** parse5's position inside that tag's attribute area at the end of the
-     *  last scanned line (see TagAttrState). A quoted value left open swallows
-     *  `>` and line endings; a `>` that arrives while `outside` ends the tag. */
-    tagAcrossLinesState: TagAttrState;
-    /** The html-flow run since the last blank REALLY started as a micromark
-     *  html block (type 6 / type 1 / a paragraph-not-interrupting type 7) —
-     *  as opposed to `htmlFlowSinceBlank`, which any `<tag` / `</tag` line
-     *  start sets (over-approximation, fine for its over-blocking uses). Only
-     *  in a real run are the bytes raw to parse5 across line endings; the
-     *  cross-line-tag garbage model (`tagAcrossLines`, pended closes) is
-     *  gated on it — in a paragraph starting `</i` the next line's `<div>` /
-     *  `<!--` are REAL blocks (oracle re-check of 2.4.4: gating on
-     *  htmlFlowSinceBlank swallowed them — a new under-block). Sticky to the
-     *  blank; a type 6/1 start on a later line of a non-real run promotes it. */
-    htmlFlowReal: boolean;
-    /** The run since the last blank was OPENED by a CommonMark type-1 block
-     *  (`<script` / `<pre` / `<style` / `<textarea`). Type 1 is the one block
-     *  that ends at its CLOSER line rather than at a blank, so `htmlFlowReal`
-     *  being "sticky to the blank" over-ran it: the line after `</script>` is
-     *  a fresh PARAGRAPH to micromark, but the scanner still treated it as
-     *  raw html flow — and in a real run end tags may carry attributes, so a
-     *  `</div a="b">` there was counted as a REAL close. `p <div> x </div
-     *  a="b"> y` after a `</script>` line therefore froze past an element the
-     *  actual parse leaves OPEN, nesting the whole rest of the document
-     *  inside it (2026-08-20 soak leg 2; identical for pre/style/textarea,
-     *  and correct as-is for a type-6 run, which really does reach the blank).
-     *  Only set when the type-1 opener is the line that STARTED the run — a
-     *  `<script>` nested inside an open type-6 block must not end it. */
-    type1FlowOpen: boolean;
-    /** The currently open raw-text element (`rawTextOpen`) was opened INLINE —
-     *  in paragraph context rather than in a real html-flow run. */
-    rawTextInline: boolean;
-    /** parse5 is in "script data escaped": a `<!--` has been seen inside the
-     *  open `<script>`. Only meaningful while `rawTextOpen === 'script'`.
-     *  Deliberately NOT cleared by `-->` — staying escaped can only poison
-     *  more often, which is the over-blocking side. */
-    scriptDataEscaped: boolean;
+    readonly '~freezeScanCheckpoint'?: never;
 }
-/** parse5 tokenizer position inside a tag's attribute area, tracked across
- *  line endings for `tagAcrossLines` (2026-08-19 review r2 P1-2 / P2-3):
- *  `outside` = before/in an attribute name (a `"` here starts a NAME, not a
- *  value); `afterEq` = just past `=`; `unquoted` = in an unquoted value
- *  (whitespace ends it); `"` / `'` = inside a quoted value — `>` and line
- *  endings are value bytes there, only the matching quote leaves it. */
-type TagAttrState = 'outside' | 'afterEq' | 'unquoted' | '"' | "'";
 declare function computeFreezeBoundary(text: string, options: FreezeBoundaryOptions, resume?: FreezeScanCheckpoint | null): FreezeScanResult;
 
 /**

package/dist/index.d.ts

@@ -316,202 +316,15 @@ interface FreezeScanResult {
      *  re-lexing the confirmed prefix. Single-consumer; see module docs. */
     checkpoint: FreezeScanCheckpoint;
 }
-interface Candidate {
-    /** Freeze boundary: start of the line after this blank line. */
-    offset: number;
-    /** Consecutive confirmed blank lines (outside fences/math) ending here. */
-    blankRun: number;
-    /** No unbalanced HTML container / comment / raw block before this point. */
-    htmlBalanced: boolean;
-    /** Rolling continuation-hazard verdict at emission (blocker 3). */
-    hazard: boolean;
-    /** Blocker-6: the run ending at this blank left balanced FLOATING raw
-     *  remnant whose hast seam is tail-dependent; reject this candidate. */
-    seamRisk: boolean;
-    /** Blocker-4 settle verdict, decided by the NEXT confirmed line (`null`
-     *  while that line hasn't confirmed — only the newest candidate can be
-     *  pending). Storing the verdict instead of the line lets the checkpoint
-     *  drop its lines array, which retained a full copy of the document
-     *  (round-2 review: ~2-3× doc size per mounted instance). */
-    defListSettled: boolean | null;
-}
-interface UnresolvedRef {
-    offset: number;
-    label: string;
-    footnote: boolean;
-}
-/** Mutable resume state. All fields describe the scan strictly BEFORE the
- *  first unconfirmed character (`confirmedOffset`). */
+/** Opaque resume token. Produced by one `computeFreezeBoundary` call and
+ *  passed back on the next APPEND-ONLY call; the only supported operations
+ *  are storing it and passing it back. The field set is an implementation
+ *  detail of the scanner and changes between minor versions — the brand key
+ *  (a structural string literal, safe across dual d.ts entries) is all that
+ *  ships in the public type. */
 interface FreezeScanCheckpoint {
-    defListEnabled: boolean;
-    /** Grammar-profile switches baked at creation — a checkpoint is only
-     *  resumable under the exact profile that built it. */
-    mathFlow: boolean;
-    referenceTaint: boolean;
-    /** Start offset of the first line NOT yet baked into this checkpoint. */
-    confirmedOffset: number;
-    candidates: Candidate[];
-    defs: Map<string, number>;
-    footnoteDefs: Map<string, number>;
-    unresolvedRefs: UnresolvedRef[];
-    tagBalance: Map<string, number>;
-    openTotal: number;
-    commentOpen: boolean;
-    piOpen: boolean;
-    declOpen: boolean;
-    cdataOpen: boolean;
-    /** parse5 BOGUS COMMENT open inside a real html-flow run: `<!` not
-     *  followed by `--` / letter / `[CDATA[`, or `</` not followed by a
-     *  letter (`<!\n`, `<!-`, `</\n`, `<//`) — eaten up to the next `>`;
-     *  a `</div>` inside is comment text, not a close (2026-08-19 review r2
-     *  P1-3: the balance zeroed past an open div). micromark has no such
-     *  construct: those bytes are just html-block content. */
-    bogusOpen: boolean;
-    /** The RAW_TEXT_ELEMENTS element currently open (its content is text to
-     *  parse5): tags and comment tokens are ignored until `</name>`. */
-    rawTextOpen: string | null;
-    inFence: boolean;
-    fenceChar: string;
-    fenceLen: number;
-    inMath: boolean;
-    /** Opening dollar-run length while inMath — the close run must match it. */
-    mathFenceLen: number;
-    /** Indent (0-3 spaces) of the line that opened the current fence/math
-     *  block. Not a blocker input — read by `phantomSuffixCloser` to emit a
-     *  closer at the SAME indent, which closes the block whether it sits at
-     *  top level (≤3 spaces are allowed there) or inside a list item whose
-     *  content indent the opener line already satisfies. */
-    openIndent: number;
-    blankRun: number;
-    lastBlankStart: number;
-    /** Rolling blocker-3 verdict ("nearest decisive block start so far"). */
-    hazardVerdict: boolean;
-    /** Previous confirmed line was blank (block-start detection). */
-    prevLineBlank: boolean;
-    /** Previous confirmed line was a plain text line (def-chain detection). */
-    prevLineWasText: boolean;
-    /** Previous confirmed line registered a VALID definition (def chains). */
-    prevLineWasValidDef: boolean;
-    /** An earlier line of the current paragraph left an unpaired backtick
-     *  run — masking is disabled until the paragraph ends (safety gate). */
-    /** A `[` left unclosed at the end of a paragraph line (code spans
-     *  masked). micromark lets a reference label span soft line breaks, so
-     *  the label may close on a LATER line where the per-line REF_RE never
-     *  sees a `[…]` pair (v2.4.1 review P1: `see [foo\nbar] end` + a late
-     *  `[foo bar]: /u` retargeted frozen output). Cleared wherever the
-     *  paragraph ends. */
-    openBracket: {
-        offset: number;
-        text: string;
-    } | null;
-    paragraphHasUnpairedRun: boolean;
-    /** Blocker-6 pending flag: a confirmed html-flow line left balanced
-     *  floating raw remnant, and no later content line has pinned the seam
-     *  yet. Persists across blank lines (every candidate emitted while set
-     *  has the remnant as its last frozen child); cleared by the next
-     *  non-blank line that starts OUTSIDE an html-flow run. */
-    htmlSeamPending: boolean;
-    /** A line since the last blank started with `<` at block indent — an html
-     *  FLOW block is (approximately) running, and it only ends at a blank
-     *  line. micromark does no inline parsing there: backtick runs are
-     *  literal text, so code-span masking would hide REAL tags from the
-     *  balance scan (under-block — fuzz counterexample: `</details>` followed
-     *  by an unblanked `` `<div>` `` line). While set, masking is skipped —
-     *  which can only over-block (safe direction). */
-    htmlFlowSinceBlank: boolean;
-    /** Offset of the first fence/math OPEN suppressed by `htmlFlowSinceBlank`
-     *  (Infinity = none). Whether the run really swallowed that line depends
-     *  on container context the line scan cannot see (`<embed` inside a list
-     *  item is a lazy paragraph line, and the glued `$$` a REAL math open —
-     *  seed-20260757 under-block: the tracker's fence phase INVERTS from that
-     *  line on, every later close reads as an open, and the corruption never
-     *  resyncs). Candidates past this offset are rejected outright — sticky,
-     *  pure over-block; candidates before it are untouched (the ambiguous
-     *  region then re-parses inside the tail). The rolling hazard poison for
-     *  ambiguous tag names stays, but it decays at the next decisive block
-     *  start — this field is the phase-corruption backstop that does not. */
-    phasePoisonedAt: number;
-    /** Tag names of line-truncated opens (`<div` at EOL) counted into
-     *  tagBalance but not yet confirmed by a later `>` — reverted at the next
-     *  blank line (a tag cannot span one). See TRUNCATED_TAG_RE. */
-    pendingTruncatedTags: string[];
-    /** Line-truncated CLOSING tags (`</div` + EOL, no `>`) inside an html-flow
-     *  run, waiting for a `>` on a later line of the same run. Unlike opens
-     *  they are NOT counted up front: a close tag cannot carry attributes, so
-     *  `para </style` (prose to micromark, still-open element to parse5 —
-     *  RAWTEXT waits for the `>`) must not zero the balance (2026-08-19
-     *  review P1 — the boundary crossed an open `<style>`). Confirmed and
-     *  applied only when a later line of the run brings the `>` (parse5
-     *  completes the end tag; micromark's block ends at the blank anyway);
-     *  dropped unapplied at the blank (element stays counted — over-block).
-     *  Paragraph-context truncated closes are never pended: a `>` at block
-     *  indent on the next line is a blockquote to micromark, and the one
-     *  shape that would complete the inline close (`</b\n    >`, a 4+-space
-     *  lazy continuation) is not modelled — the element stays counted,
-     *  over-block. */
-    pendingTruncatedCloses: string[];
-    /** An html-flow line ended inside a tag (`<div`, `</div`, `<br` — open,
-     *  close or void, with or without attributes): parse5's tokenizer is
-     *  still in that tag, so on the following lines everything up to the
-     *  FIRST `>` is attribute garbage — `</div>` there does NOT close
-     *  anything (oracle review of 2.4.4: `<div>\n<div>\n</div\n</div>` froze
-     *  past the still-open outer div; pre-existing, 1-char slices). While
-     *  set: a line without `>` gets no tag scan at all; the line with the
-     *  `>` completes the pending close (if any), then only its text after
-     *  that `>` is scanned. Cleared there and at the blank line. */
-    tagAcrossLines: boolean;
-    /** Indent of the line that set `tagAcrossLines`. A following line that
-     *  DE-INDENTS below it may have left the container (a list item's html
-     *  block ends there; hast-util-raw resets the tokenizer at the li/ul
-     *  boundary, so a `<div>` on that line is a real start tag, not garbage)
-     *  — or may still be the same html block (root-level `  </div\n</div>`,
-     *  still garbage). Unknowable here → poison (oracle 3rd pass). */
-    tagAcrossLinesIndent: number;
-    /** parse5's position inside that tag's attribute area at the end of the
-     *  last scanned line (see TagAttrState). A quoted value left open swallows
-     *  `>` and line endings; a `>` that arrives while `outside` ends the tag. */
-    tagAcrossLinesState: TagAttrState;
-    /** The html-flow run since the last blank REALLY started as a micromark
-     *  html block (type 6 / type 1 / a paragraph-not-interrupting type 7) —
-     *  as opposed to `htmlFlowSinceBlank`, which any `<tag` / `</tag` line
-     *  start sets (over-approximation, fine for its over-blocking uses). Only
-     *  in a real run are the bytes raw to parse5 across line endings; the
-     *  cross-line-tag garbage model (`tagAcrossLines`, pended closes) is
-     *  gated on it — in a paragraph starting `</i` the next line's `<div>` /
-     *  `<!--` are REAL blocks (oracle re-check of 2.4.4: gating on
-     *  htmlFlowSinceBlank swallowed them — a new under-block). Sticky to the
-     *  blank; a type 6/1 start on a later line of a non-real run promotes it. */
-    htmlFlowReal: boolean;
-    /** The run since the last blank was OPENED by a CommonMark type-1 block
-     *  (`<script` / `<pre` / `<style` / `<textarea`). Type 1 is the one block
-     *  that ends at its CLOSER line rather than at a blank, so `htmlFlowReal`
-     *  being "sticky to the blank" over-ran it: the line after `</script>` is
-     *  a fresh PARAGRAPH to micromark, but the scanner still treated it as
-     *  raw html flow — and in a real run end tags may carry attributes, so a
-     *  `</div a="b">` there was counted as a REAL close. `p <div> x </div
-     *  a="b"> y` after a `</script>` line therefore froze past an element the
-     *  actual parse leaves OPEN, nesting the whole rest of the document
-     *  inside it (2026-08-20 soak leg 2; identical for pre/style/textarea,
-     *  and correct as-is for a type-6 run, which really does reach the blank).
-     *  Only set when the type-1 opener is the line that STARTED the run — a
-     *  `<script>` nested inside an open type-6 block must not end it. */
-    type1FlowOpen: boolean;
-    /** The currently open raw-text element (`rawTextOpen`) was opened INLINE —
-     *  in paragraph context rather than in a real html-flow run. */
-    rawTextInline: boolean;
-    /** parse5 is in "script data escaped": a `<!--` has been seen inside the
-     *  open `<script>`. Only meaningful while `rawTextOpen === 'script'`.
-     *  Deliberately NOT cleared by `-->` — staying escaped can only poison
-     *  more often, which is the over-blocking side. */
-    scriptDataEscaped: boolean;
+    readonly '~freezeScanCheckpoint'?: never;
 }
-/** parse5 tokenizer position inside a tag's attribute area, tracked across
- *  line endings for `tagAcrossLines` (2026-08-19 review r2 P1-2 / P2-3):
- *  `outside` = before/in an attribute name (a `"` here starts a NAME, not a
- *  value); `afterEq` = just past `=`; `unquoted` = in an unquoted value
- *  (whitespace ends it); `"` / `'` = inside a quoted value — `>` and line
- *  endings are value bytes there, only the matching quote leaves it. */
-type TagAttrState = 'outside' | 'afterEq' | 'unquoted' | '"' | "'";
 declare function computeFreezeBoundary(text: string, options: FreezeBoundaryOptions, resume?: FreezeScanCheckpoint | null): FreezeScanResult;
 
 /**

package/dist/index.dev.cjs

@@ -337,6 +337,26 @@ var HTML_BREAKOUT_TAGS = /* @__PURE__ */ new Set([
   "var"
 ]);
 var HTML_INTEGRATION_POINTS = ["foreignobject", "desc", "title", "mi", "mo", "mn", "ms", "mtext", "annotation-xml"];
+var SCOPE_BARRIER_NAMES = /* @__PURE__ */ new Set([
+  "applet",
+  "caption",
+  "html",
+  "table",
+  "td",
+  "th",
+  "marquee",
+  "object",
+  "template",
+  "mi",
+  "mo",
+  "mn",
+  "ms",
+  "mtext",
+  "annotation-xml",
+  "foreignobject",
+  "desc",
+  "title"
+]);
 var FOREIGN_ROOT_NAMES = ["svg", "math"];
 var TYPE1_NAMES = /* @__PURE__ */ new Set(["script", "pre", "style", "textarea"]);
 var RAW_TEXT_ELEMENTS = /* @__PURE__ */ new Set([
@@ -507,6 +527,7 @@ function freshCheckpoint(defListEnabled, mathFlow, referenceTaint) {
     piOpen: false,
     bogusOpen: false,
     rawTextOpen: null,
+    openStack: [],
     scriptDataEscaped: false,
     declOpen: false,
     cdataOpen: false,
@@ -630,7 +651,8 @@ function classifyBlockStart(text, indent, defListEnabled) {
 function computeFreezeBoundary(text, options, resume) {
   const mathFlow = options.mathFlow ?? true;
   const referenceTaint = options.referenceTaint ?? true;
-  const cp = resume && resume.defListEnabled === options.defListEnabled && resume.mathFlow === mathFlow && resume.referenceTaint === referenceTaint && resume.confirmedOffset <= text.length ? resume : freshCheckpoint(options.defListEnabled, mathFlow, referenceTaint);
+  const prev = resume;
+  const cp = prev && prev.defListEnabled === options.defListEnabled && prev.mathFlow === mathFlow && prev.referenceTaint === referenceTaint && prev.confirmedOffset <= text.length ? prev : freshCheckpoint(options.defListEnabled, mathFlow, referenceTaint);
   let start = cp.confirmedOffset;
   let tailLine = null;
   while (start < text.length) {
@@ -693,6 +715,14 @@ function computeFreezeBoundary(text, options, resume) {
   }
   return { boundary, checkpoint: cp };
 }
+function pendingFenceCloser(checkpoint) {
+  const cp = checkpoint;
+  if (cp.phasePoisonedAt !== Infinity) return "";
+  if (cp.openIndent !== 0) return "";
+  if (cp.inFence) return cp.fenceChar.repeat(cp.fenceLen);
+  if (cp.inMath) return "$".repeat(cp.mathFenceLen);
+  return "";
+}
 function floatingResidue(text, commentOpenAtStart) {
   let out = "";
   let open = commentOpenAtStart;
@@ -768,6 +798,7 @@ function processConfirmedLine(cp, ln, text) {
         cp.openTotal -= count;
       }
     }
+    if (cp.openStack.length > 0) cp.openStack = cp.openStack.filter((n) => !FOREIGN_ROOT_NAMES.includes(n));
   };
   const noteBreakout = (tag, closing) => {
     if (closing || cp.rawTextOpen !== null) return;
@@ -791,13 +822,25 @@ function processConfirmedLine(cp, ln, text) {
       }
     }
     if (DOCUMENT_STRUCTURE_NAMES.has(tag)) cp.phasePoisonedAt = 0;
+    if (tag === "template" && !closing) cp.phasePoisonedAt = 0;
     if (closing) {
+      let idx = -1;
+      for (let i = cp.openStack.length - 1; i >= 0; i--) {
+        if (cp.openStack[i] === tag) {
+          idx = i;
+          break;
+        }
+        if (SCOPE_BARRIER_NAMES.has(cp.openStack[i])) break;
+      }
+      if (idx === -1) return;
+      cp.openStack.splice(idx, 1);
       const count = cp.tagBalance.get(tag) ?? 0;
       if (count > 0) {
         cp.tagBalance.set(tag, count - 1);
         cp.openTotal -= 1;
       }
     } else {
+      cp.openStack.push(tag);
       cp.tagBalance.set(tag, (cp.tagBalance.get(tag) ?? 0) + 1);
       cp.openTotal += 1;
     }
@@ -916,6 +959,9 @@ function processConfirmedLine(cp, ln, text) {
     if (!cp.type1FlowOpen) {
       cp.htmlFlowSinceBlank = false;
       cp.htmlFlowReal = false;
+      if (cp.rawTextOpen !== null && !cp.rawTextInline) {
+        cp.phasePoisonedAt = 0;
+      }
     }
     cp.prevLineBlank = true;
     cp.prevLineWasText = false;
@@ -1015,6 +1061,7 @@ ${cont(scanText)}` };
   const poisonRawDivergence = () => {
     cp.phasePoisonedAt = Math.min(cp.phasePoisonedAt, ln.start);
   };
+  let inlineRawOpenerIdx = -1;
   while (pos < scanText.length) {
     if (cp.piOpen) {
       const c = scanText.indexOf("?>", pos);
@@ -1070,6 +1117,7 @@ ${cont(scanText)}` };
     } else if (first === cd) {
       rawSpans.push([cd, cd + 9]);
       cp.cdataOpen = true;
+      if (!isMdBlank(scanText.slice(0, cd)) || ln.indent > 3) inlineRawOpenerIdx = cd;
       pos = cd + 9;
     } else if (first === pi) {
       if (scanText[pi + 2] === ">") {
@@ -1080,14 +1128,19 @@ ${cont(scanText)}` };
       }
       rawSpans.push([pi, pi + 2]);
       cp.piOpen = true;
+      if (!isMdBlank(scanText.slice(0, pi)) || ln.indent > 3) inlineRawOpenerIdx = pi;
       pos = pi + 2;
     } else {
       rawSpans.push([decl, decl + 2]);
       if (ln.indent <= 3 && /^doctype/i.test(scanText.slice(decl + 2))) cp.phasePoisonedAt = 0;
       cp.declOpen = true;
+      if (!isMdBlank(scanText.slice(0, decl)) || ln.indent > 3) inlineRawOpenerIdx = decl;
       pos = decl + 2;
     }
   }
+  if (inlineRawOpenerIdx !== -1 && (cp.piOpen || cp.declOpen || cp.cdataOpen)) {
+    cp.phasePoisonedAt = 0;
+  }
   let tagText = scanText;
   for (const [from, to] of rawSpans) {
     tagText = tagText.slice(0, from) + " ".repeat(to - from) + tagText.slice(to);
@@ -1176,9 +1229,9 @@ ${cont(scanText)}` };
       if (VOID_TAGS.has(tag) || selfClosing && honoursSelfClosing(tag)) continue;
       applyTag(tag, closing);
     }
-    if (cp.commentOpen && lastCommentOpenerIdx !== -1 && !inRawText) {
-      if (!isMdBlank(tagText.slice(0, lastCommentOpenerIdx))) {
-        cp.phasePoisonedAt = Math.min(cp.phasePoisonedAt, ln.start + lastCommentOpenerIdx);
+    if (cp.commentOpen && lastCommentOpenerIdx !== -1) {
+      if (!isMdBlank(tagText.slice(0, lastCommentOpenerIdx)) || ln.indent > 3) {
+        cp.phasePoisonedAt = 0;
       }
     }
     if (masked !== null && masked !== ln.text) {
@@ -1478,6 +1531,40 @@ function hasStrayTablePart(values) {
   }
   return false;
 }
+var HEAD_ROUTED_NAMES = /* @__PURE__ */ new Set([
+  "base",
+  "basefont",
+  "bgsound",
+  "link",
+  "meta",
+  "noframes",
+  "script",
+  "style",
+  "template",
+  "title"
+]);
+var HEAD_ROUTED_RAW_TEXT_RE = /<(script|style|title|noframes)(?=[\s/>])/i;
+var ANY_START_TAG_RE = /<([a-z][a-z0-9-]*)(?=[\s/>])/gi;
+function headRoutedCaptureUnclosed(values) {
+  if (values.length === 0) return false;
+  const joined = values.join("\n");
+  const opener = HEAD_ROUTED_RAW_TEXT_RE.exec(joined);
+  if (opener === null) return false;
+  const before = joined.slice(0, opener.index);
+  if (/<[!?]/.test(before)) return true;
+  ANY_START_TAG_RE.lastIndex = 0;
+  let m;
+  while ((m = ANY_START_TAG_RE.exec(before)) !== null) {
+    if (!HEAD_ROUTED_NAMES.has(m[1].toLowerCase())) return false;
+  }
+  const name = opener[1].toLowerCase();
+  const after = joined.slice(opener.index + opener[0].length);
+  if (name === "script") {
+    const close = after.search(/<\/script(?=[\s/>])/i);
+    return close === -1 || /<!--/.test(after.slice(0, close));
+  }
+  return !new RegExp(`</${name}(?=[\\s/>])`, "i").test(after);
+}
 var STRAY_SYNTHESIZED_END_TAG_RE = /<\/(?:br|p)\b/i;
 function spliceTrees(input) {
   const { prevMdast, prevHast, tailMdast, tailHast, content, boundary, injectionPrefix, injectedSegments } = input;
@@ -1536,11 +1623,14 @@ function spliceTrees(input) {
   });
   const tailWrapVisible = tailMdastChildren.some((child) => !isWrapInvisible(child));
   if (hasStrayTablePart(prefixMdast.flatMap((c) => c.type === "html" ? [c.value] : []))) return null;
+  const leadingHtml = [];
   for (const child of tailMdastChildren) {
     if (isWrapInvisible(child)) continue;
     if (child.type !== "html") break;
     if (STRAY_SYNTHESIZED_END_TAG_RE.test(child.value) || TABLE_PART_TAG_RE.test(child.value)) return null;
+    leadingHtml.push(child.value);
   }
+  if (headRoutedCaptureUnclosed(leadingHtml)) return null;
   const aligned = alignPrefixCut(prefixMdast, cutRegion, tailWrapVisible);
   if (aligned === null) return null;
   const hastChildren = aligned.children;
@@ -2184,12 +2274,10 @@ function phantomSuffixCloser(content) {
   const endsWithNewline = content.endsWith("\n");
   const confirmed = endsWithNewline ? content : content + "\n";
   const { checkpoint } = computeFreezeBoundary(confirmed, { defListEnabled: false, referenceTaint: false });
-  if (checkpoint.phasePoisonedAt !== Infinity) return "";
-  if (checkpoint.openIndent !== 0) return "";
-  const nl = endsWithNewline ? "" : "\n";
-  if (checkpoint.inFence) return `${nl}${checkpoint.fenceChar.repeat(checkpoint.fenceLen)}`;
-  if (checkpoint.inMath) return `${nl}${"$".repeat(checkpoint.mathFenceLen)}`;
-  return "";
+  const closer = pendingFenceCloser(checkpoint);
+  if (closer === "") return "";
+  return endsWithNewline ? closer : `
+${closer}`;
 }
 
 // src/components/extractContributions.ts
@@ -2465,7 +2553,7 @@ function createRegistry(onEmpty) {
 
 // src/components/pluginChain.ts
 var import_rehype_katex = __toESM(require("rehype-katex"), 1);
-var import_rehype_raw = __toESM(require("rehype-raw"), 1);
+var import_rehype_raw = __toESM(require("@ai-markdown/rehype-raw"), 1);
 var import_rehype_unwrap_images = __toESM(require("rehype-unwrap-images"), 1);
 
 // src/components/rehypeUnwrapCrossChunkImages.ts