@aiquants/markdown 5.0.0 → 6.1.0

package/README.md

@@ -6,7 +6,7 @@ Advanced Markdown renderer for React with support for various extensions and cus
 
 - **Rich Markdown Support**: Full support for CommonMark, GitHub Flavored Markdown (GFM), and LaTeX Math expressions.
 - **Offloaded Parser**: CPU-heavy Markdown parsing and AST transformation are offloaded to a high-performance Go API server running `goldmark` and `ConnectRPC`.
-- **Custom Extensions & Plugins**: GitHub alerts, Zenn-style directives (`:::message` / `:::details`), single-line display math, and pluggable subscript, superscript, mark highlights, table cell merges and embeds (YouTube, Twitter).
+- **Custom Extensions & Plugins**: GitHub alerts, Zenn-style directives (`:::message` / `:::details`), single-line display math, and pluggable subscript, superscript, mark highlights, table cell merges, and opt-in embeds: posts and videos of ten SNS and video providers as script-free cross-origin frames, and link cards from the host's metadata endpoint.
 - **Dynamic Configuration**: Easily enable or disable custom extensions dynamically using parse options.
 - **Syntax Highlighting**: Code blocks with Shiki syntax highlighting.
 - **TypeScript**: Full TypeScript support with comprehensive type definitions.
@@ -71,9 +71,13 @@ export MARKDOWN_API_BINARY=/path/to/markdown-api
 
 ```tsx
 import { MarkdownRenderer } from "@aiquants/markdown"
+import type { MarkdownEmbeds } from "@aiquants/markdown/embeds"
 import { parseMarkdown } from "@aiquants/markdown/server"
 import "@aiquants/markdown/styles/markdown.css"
 
+// A module constant: the providers whose posts embed, and the host's link-card endpoint (see Embeds)
+const EMBEDS: MarkdownEmbeds = { providers: ["youtube", "x"], linkCardEndpoint: "/api/site_metadata" }
+
 const MyComponent = async () => {
   const markdownText = `# Hello World
 
@@ -103,7 +107,7 @@ console.log("Hello, World!")
     <MarkdownRenderer 
       htmlContent={parseResult.htmlContent} 
       theme="light" 
-      iFrameAllowedDomains={["www.youtube.com"]} 
+      embeds={EMBEDS}
     />
   )
 }
@@ -133,7 +137,7 @@ const parseResult = await parseMarkdown(
     enableSuperscript: true,           // Enable superscript
     enableMark: false,                 // Disable highlight mark
     enableTableMerge: true,            // Enable table merges (> and ^)
-    enableEmbeds: true,                // Enable YouTube / Twitter embeds
+    enableEmbeds: true,                // Mark a paragraph holding one web link (data-embed-url)
     enableZennDirectives: true         // Enable :::message / :::details
   }
 )
@@ -187,28 +191,162 @@ Every renderer of the package — `MarkdownRenderer` (and so `MarkdownViewer`) f
 - **Kept**: the elements Markdown produces and common text and structure elements (`a`, `img`, `p`, `div`, `span`, headings, lists, tables, `blockquote`, `pre`, `code`, `details`, `summary`, `aside`, `section`, `figure`, `sup`, `sub`, `mark`, `video`, `audio`, `source` …) and, for icons, an `svg` with `g` and `path` inside it (anything else inside an `svg` is removed).
 - **Unwrapped** (the element is dropped, its children render): every other element — `form`, `button`, `textarea`, `label`, `font`, `center`, custom elements and the like — so its text survives.
 - **Attributes**: `title`, `lang`, `dir`, `role`, `hidden`, `translate`, `aria-*`, a reduced `class`, `id` and `style`, and each element's own (`href`, `src`, `alt`, `width`, `height`, `colspan`, `rowspan`, `align`, `open`, `start` …; a link keeps `name`, the fragment target of older documents).
-  The `data-*` attributes the renderers read survive on their element only: `data-link-kind`, `data-doc-path`, `data-doc-exists`, `data-footnote-ref` and `data-footnote-backref` on links, `data-asset-src` and `data-asset-exists` on images, `data-footnotes` on sections, and the embed placeholders' `data-plugin-type`, `data-video-id`, `data-tweet-id` and `data-url` on `div`. Event handlers, `target`, `rel`, `name` (except on links), `srcset`, `usemap`, `ping`, `formaction`, `xlink:href`, `tabindex` and every other attribute are dropped.
+  The `data-*` attributes the renderers read survive on their element only: `data-link-kind`, `data-doc-path`, `data-doc-exists`, `data-footnote-ref` and `data-footnote-backref` on links, `data-asset-src` and `data-asset-exists` on images, and `data-footnotes` on sections. A paragraph's `data-embed-url` never renders: when it is a safe URL the paragraph becomes an embed placeholder (see [Embeds](#embeds)); the 5.x `div` markers (`data-plugin-type`, `data-video-id`, `data-tweet-id`, `data-url`) are dropped.
+  Event handlers, `target`, `rel`, `name` (except on links), `srcset`, `usemap`, `ping`, `formaction`, `xlink:href`, `tabindex` and every other attribute are dropped.
 - **Attribute names** are read as an HTML parser stores them: in lower case, and of names that differ only in case the first one written. Kept attributes carry lower-case names, so `<p STYLE="text-align:center">` or `<a HREF="https://…">` renders the same on the server (where html-react-parser keeps the author's case) and in the browser, and hydrates without a mismatch.
 - **`class`** keeps only the package's own tokens: the converter's markup (`markdown-alert`, `markdown-alert-{note,tip,important,warning,caution}`, `markdown-alert-title`, `octicon`, `octicon-{info,light-bulb,report,alert,stop}`, `mr-2`, `message`, `alert`, `info`, `warning`, `message-symbol`, `message-content`, `markdown-details`, `markdown-details-content`, `footnotes`, `footnote-ref`, `footnote-backref`, `math`, `inline`, `display`) and a code block's language (`language-*`).
   An author's tokens and utility classes (`fixed inset-0 z-50` …) are dropped, so a document can neither restyle the page nor lay an element over it; a link's `className` (also the one `linkComponent` receives) holds only the kept tokens and the package's link classes. Tables carry their alignment in `align` and `style`, not in classes.
 - **`id`** survives only on a heading (the table of contents, in-document links and a host's fragment navigation name headings by it), on the converter's footnotes (`fnref:N` / `fnrefK:N` on a reference's `sup`, `fn:N` on a note's `li`) and in the user-content namespace (`user-content-…`, the prefix GitHub-style footnotes use; write raw HTML fragment targets with it, or as `<a name="…">`).
-  Every other element loses its id, so a document cannot take a name the page or a script looks up (`getElementById`, the named properties of `window`). A heading keeps whatever id the document gives it: a host should not look up its own elements by an id a document could also give a heading (prefer refs), and the package's own lookups check what they find (see [Embeds](#embeds)).
+  Every other element loses its id, so a document cannot take a name the page or a script looks up (`getElementById`, the named properties of `window`). A heading keeps whatever id the document gives it: a host should not look up its own elements by an id a document could also give a heading (prefer refs).
 - **Host sanitizers**: a host that sanitizes the HTML before the renderer (as `@aiquants/markdown-explorer` does with DOMPurify) gets the intersection of both allow lists; DOMPurify keeps `class` and `id` by default, so on the page the rules above are the ones that apply.
-- **URLs** (`href`, `src`, `cite`, `poster`, `data-url`): `http:`, `https:`, `mailto:` and `tel:` in any letter case, and references without a scheme. `javascript:`, `data:` and every other scheme are dropped, however they are spelled (entities, spaces, tabs, control characters). The mdast `LinkNode` and `ImageNode`, the block link card `RichLinkCard` (its `href`, and the `url` and `image` of the site metadata it shows) and the table of contents' entries follow the same rule.
+- **URLs** (`href`, `src`, `cite`, `poster`, `data-embed-url`): `http:`, `https:`, `mailto:` and `tel:` in any letter case, and references without a scheme. `javascript:`, `data:` and every other scheme are dropped, however they are spelled (entities, spaces, tabs, control characters). The mdast `LinkNode` and `ImageNode`, link cards (their link, image and icon) and the table of contents' entries follow the same rule.
 - **`style`** keeps only its last valid `text-align` declaration (the alignment of table cells); positioning, `url()` and every other declaration are dropped. An SVG `fill` that references anything (`url(…)`) is dropped.
 
 ### Embeds
 
-- `iFrameAllowedDomains` lists the hostnames an iframe may load from: the `src` must be `https:`, without a user name, a password or an explicit port, and its hostname must match an entry exactly. Every other iframe is removed (fail closed), including an iframe without `src` (`srcdoc`). An allowed iframe is rendered from validated values and keeps only `title`, `width`, `height`, `allow`, `allowfullscreen`, `sandbox`, `referrerpolicy`, `loading`, `frameborder` and `scrolling` (no `id` or `class`: the package's markup gives an iframe neither).
-  `allow` keeps each feature's name without its allowlist, so a feature applies to the embedded origin only (`camera *; microphone 'self' https://x.example` becomes `camera; microphone`); `referrerpolicy` is kept only as `no-referrer`, `origin`, `same-origin`, `strict-origin` or `strict-origin-when-cross-origin`.
-- An iframe plugin (`data-plugin-type="dify"`) receives the validated iframe as structured props, never as an HTML string. The Dify plugin acts only on messages its own frame's window posts from an allowed origin, and ignores a message that is not an object with a string `type`.
-- A YouTube embed loads the player only when `www.youtube.com` is in `iFrameAllowedDomains`; otherwise it renders a link to the video's watch page.
-- A tweet renders as a link to its address unless the host sets `allowTwitterWidgetScript` (on `MarkdownRenderer` and `MarkdownViewer`), which lets the page load and run `https://platform.twitter.com/widgets.js`. The widgets are taken from that script only: an existing copy is found as a `script` element with that `src` (never by the `twitter-wjs` id), and `window.twttr.widgets` is used only when its `createTweet` is a function, so an element a document names `twitter-wjs` or `twttr` cannot block or impersonate it.
+Embeds are opt in. `MarkdownRenderer` and `MarkdownViewer` take `embeds={{ providers, linkCardEndpoint, linkCardSize }}` (type `MarkdownEmbeds` from `@aiquants/markdown/embeds`; `linkCardSize` is optional); the default `NO_EMBEDS` renders every link alone in a paragraph as that paragraph. Pass the value from a module constant (the viewer also compares it by value). An unknown provider id, a bad endpoint or an unknown card size throws a `RangeError` at render.
 
 ```tsx
-<MarkdownViewer {...props} iFrameAllowedDomains={["www.youtube.com"]} allowTwitterWidgetScript={false} />
+import type { MarkdownEmbeds } from "@aiquants/markdown/embeds"
+
+const EMBEDS: MarkdownEmbeds = { providers: ["youtube", "x", "instagram", "bluesky"], linkCardEndpoint: "/api/link-card", linkCardSize: "banner" }
+
+<MarkdownViewer {...props} embeds={EMBEDS} iFrameAllowedDomains={["www.youtube.com"]} />
 ```
 
+**What a link alone in a paragraph becomes.** The converter marks a paragraph whose only element is one link to an absolute `http(s)` URL without a user name or password (besides white space, U+00A0 and U+3000) with `data-embed-url`, and keeps the paragraph and the link. The renderer then decides, in this order:
+
+1. The marked link must be the paragraph's only link, with the same sanitized `href` (`placeholderLinkOf`); otherwise the paragraph renders as written.
+2. The fallback is a link card when `linkCardEndpoint` is set and the link's text is the URL itself (`isBareLink`), otherwise the paragraph.
+3. An enabled provider that recognizes the URL embeds its post or video, whatever the link text says, with the paragraph's own link as the caption; otherwise the fallback renders.
+
+The link is always kept: under the frame, as the card, or as the paragraph.
+
+| Provider id | URLs it recognizes | Frame origin |
+| --- | --- | --- |
+| `youtube` | `www.youtube.com`, `youtube.com`, `m.youtube.com`: `/watch?v=` (any position; `si`, `list`, `feature` ignored), `/shorts/ID`, `/live/ID`, `/embed/ID`; `youtu.be/ID`; `www.youtube-nocookie.com/embed/ID` | `https://www.youtube-nocookie.com` |
+| `x` | `x.com`, `twitter.com` (`www.`, `mobile.`): `/USER/status/ID` (with `/photo/N` or `/video/N`), `/i/web/status/ID` | `https://platform.twitter.com` |
+| `instagram` | `www.instagram.com`, `instagram.com`, `instagr.am`: `/p/CODE`, `/reel/CODE`, `/USER/p/CODE`, `/USER/reel/CODE` | `https://www.instagram.com` |
+| `threads` | `www.threads.com`, `threads.com`, `www.threads.net`, `threads.net`: `/@USER/post/CODE` | `https://www.threads.com` |
+| `tiktok` | `www.tiktok.com`, `tiktok.com`: `/@USER/video/ID`, `/player/v1/ID`, `/embed/v2/ID` | `https://www.tiktok.com` |
+| `bluesky` | `bsky.app/profile/ACTOR/post/RKEY` (a DID, or a handle looked up at `https://public.api.bsky.app`) | `https://embed.bsky.app` |
+| `linkedin` | `www.linkedin.com`, `linkedin.com`: `/feed/update/URN`, `/embed/feed/update/URN`, `/posts/…-activity-ID-…` | `https://www.linkedin.com` |
+| `reddit` | `www.reddit.com`, `reddit.com`, `old.reddit.com`, `new.reddit.com`: `/r/SUB/comments/ID[/SLUG]` | `https://embed.reddit.com` |
+| `note` | `note.com/USER/n/KEY` | `https://note.com` |
+| `niconico` | `www.nicovideo.jp`, `nicovideo.jp`: `/watch/ID`; `nico.ms/ID` | `https://embed.nicovideo.jp` |
+
+Every host must match exactly (look-alike hosts, user info, ports and URLs carrying a provider URL in their query never match), and each path segment must match its own grammar. Short links without an id, Facebook, Pinterest, TikTok photo posts and LinkedIn articles have no provider: as bare URLs they become cards.
+
+**Frames.** No provider script ever runs in the page: posts and videos are cross-origin iframes with the registry's attributes (an `allow` within the six shared features, a `sandbox`, a referrer policy, `loading="lazy"`), titled `"<provider>: <label>"`. Every iframe — provider frames, iframes written in documents and the Dify plugin — mounts only on the client after hydration, and **never when its origin is the page's own origin**, whatever the host allows.
+The server HTML holds the link and a reserved box (`width: 100%` up to the provider's maximum, its aspect ratio or height, never a CSS `min-width`), hidden for readers without JavaScript. A frame whose box is narrower than the provider's minimum (YouTube 356 px, Shorts 200 px, X 250 px, Instagram 326 px, Threads 281 px, Bluesky 300 px) shows the fallback instead, and mounts again when the pane widens. X follows the primary subtag of the page's `<html lang>`; X, Threads and Bluesky follow `theme`.
+Frames that report their height (X, Instagram, Threads, Bluesky, Reddit, note) are sized through one `message` listener that accepts only the frame's own window from its exact provider origin.
+
+**Link cards.** A card asks `GET <linkCardEndpoint>?url=<href>` (same-origin credentials, `redirect: "error"`) once an IntersectionObserver rooted at the viewer's scroller sees it, through a page-wide queue (two requests at once, 256 answers kept, aborted when no card needs the answer).
+It links to the written `href` (never `og:url`), takes the host name from the `href`, and shows the image and the icon only when the endpoint gives absolute `http(s)` URLs of at most 2048 characters (`LINK_CARD_URL_LIMIT`) that are not on the page's own host, whatever the scheme or port (a browser loads an `http:` image of an `https:` page over `https:`, and cookies ignore the port), with no referrer. The package asks no favicon service.
+
+`linkCardSize` picks the size of every card:
+
+| `linkCardSize` | The card |
+| --- | --- |
+| `"banner"` (default) | Image, title (two lines), description (one line) and `site · host`, 7.5rem tall, as wide as the column up to 37.5rem (600px) and left-aligned. The image is 1.91:1 from a card width of 32rem, square from 22rem, hidden below. |
+| `"full"` | Image, title and description (two lines each) and `site · host`, 8.5rem tall, across the column. The image is 1.91:1 from 40rem, square from 22rem, hidden below. |
+| `"compact"` | The favicon (or a neutral link icon), the title on one line and `site · host`, 3.75rem tall, as wide as its text up to 37.5rem. No image and no description. |
+
+A pending card has the height of the chosen size, so an answer never shifts the page. A link the endpoint gives no card (a `204 No Content` with a reason, below) becomes a compact card whatever the size: a leading icon — a building for `private-network`, a globe otherwise — then the host name and the URL, marked `data-link-card="compact"` and `data-link-card-reason="<reason>"`. It may shrink a pending banner or full card; Chromium's scroll anchoring keeps the visible content in place when that happens above the viewport. An error answer renders the paragraph.
+Every link that gets no full card writes one `console.info` line naming the link and the reason, for example `[markdown] No link card for <href> (private-network)`; an error answer names its cause instead — `HTTP <status>` for another status, `HTTP 204 without a known skip reason` for a 204 whose `X-Link-Card-Skip` is missing or unknown, `HTTP 200, not JSON` or `HTTP 200, not a JSON object` for a 200 that is not a JSON object, `network error` for a failed request — and a card that unmounts before its answer writes nothing.
+The card's look — light and dark (`data-theme`), hover, keyboard focus ring — comes from `styles/markdown.css`, outside every cascade layer, so the GitHub and Zenn display styles cannot override it; every size shares that one frame.
+
+The endpoint contract:
+
+- `GET <endpoint>?url=<href>` answers JSON `{ title?, description?, site_name?, image?, icon? }`; other fields (`url` included) are ignored.
+- A link that gets no card is answered `204 No Content` with the reason in `X-Link-Card-Skip` (`LINK_CARD_SKIP_HEADER`): `private-network`, `forbidden-url`, `unreachable` or `not-html` (`LINK_CARD_SKIP_REASONS`, read with `linkCardSkipReasonOf`). A 204 without one of them is an error answer.
+- It must not set cookies or refresh credentials: the request runs in the background and can be in flight during a sign-out.
+- A redirect, any other non-OK status or a non-JSON answer is an error answer: no card, the paragraph.
+- `createLinkCardHandler` from `@aiquants/markdown/server` implements this contract (see [Link-card endpoint](#link-card-endpoint)).
+
+**Iframes written in documents.** `iFrameAllowedDomains` lists the hostnames such an iframe may load from: the `src` must be `https:`, without a user name, a password or an explicit port, and its hostname must match an entry exactly. Every other iframe is removed (fail closed), including an iframe without `src` (`srcdoc`). An allowed iframe is rendered from validated values and keeps only `title`, `width`, `height`, `allow`, `allowfullscreen`, `sandbox`, `referrerpolicy`, `loading`, `frameborder` and `scrolling` (no `id` or `class`).
+An iframe without a `title` gets `"<embeddedFrame>: <host>"` (for example `Embedded content: www.youtube.com`), marked with the built-in label's language.
+`allow` keeps only the six shared frame features — `autoplay`, `clipboard-write`, `encrypted-media`, `fullscreen`, `picture-in-picture`, `web-share` — each without its allowlist (`camera; microphone; autoplay` becomes `autoplay`); `referrerpolicy` is kept only as `no-referrer`, `origin`, `same-origin`, `strict-origin` or `strict-origin-when-cross-origin`. Until it mounts, and for good when its origin is the page's, the iframe renders as `<span data-embed-frame="pending|refused">` holding a link to its `src`.
+An iframe inside a link never mounts and stays that text, without a nested link: interactive content may not sit inside an `<a>`, and activating the link would follow the author's URL instead of the frame.
+An iframe plugin (`data-plugin-type="dify"`) receives the validated iframe as structured props, never as an HTML string. The Dify plugin acts only on messages its own frame's window posts from an allowed origin, and ignores a message that is not an object with a string `type`.
+
+**Labels.** `embedLabels` (`embeddedVideo`, `embeddedPost`, `embeddedFrame`; built-in "embedded video", "embedded post", "Embedded content", in `DEFAULT_MARKDOWN_EMBED_LABELS`) name the frames; `MarkdownViewer` takes the same keys in `labels`.
+
+**DOM hooks.** `figure[data-embed-provider][data-embed-state="pending|frame"]` with its box `[data-embed-box]`, the width probe `[data-embed-measure]`, `span[data-embed-frame]` for iframes written in documents, and `a[data-link-card="pending|ready|compact"][data-link-card-size="compact|banner|full"]` (a compact card of a skipped link also carries `data-link-card-reason`).
+
+**Content Security Policy.** Put `embedFrameHostsOf(embeds.providers)` and the hosts of `iFrameAllowedDomains` in `frame-src`, `embedConnectOriginsOf(embeds.providers)` in `connect-src` (Bluesky handles), and allow `https:` images in `img-src` for card images and icons. Provider frames may open popups that escape their sandbox, so a host that enables providers should send `Cross-Origin-Opener-Policy: same-origin`.
+
+`@aiquants/markdown/embeds` holds the placeholder contract, the frame policy, the provider registry and the card contract without React, for host sanitizers, configuration and CSP. `@aiquants/markdown/embeds/testing` holds captured provider messages and `embedProviderStubPage(url)` for offline end-to-end tests.
+
+### Link-card endpoint
+
+`createLinkCardHandler(options)` from `@aiquants/markdown/server` (Node only) is the card endpoint as a standard handler, `(request: Request) => Promise<Response>`. It reads only the request's method and its `url` search parameter, never its path, so mount it on any path and pass that path as `embeds.linkCardEndpoint`. Create it once, at module scope: each handler owns its cache and its connection pool. It uses `undici` and `htmlparser2`, which no client entry loads (`@aiquants/markdown/embeds` stays free of React and Node).
+
+A React Router resource route (`app/routes/api.link-card.ts`, for example):
+
+```ts
+import { createLinkCardHandler } from "@aiquants/markdown/server"
+import type { LoaderFunctionArgs } from "react-router"
+import { readSignedInReader } from "~/session.server" // the host's read-only session lookup
+
+const linkCards = createLinkCardHandler({ authorize: async (request) => (await readSignedInReader(request)) !== undefined })
+
+export const loader = ({ request }: LoaderFunctionArgs) => linkCards(request)
+```
+
+Any server whose handlers take a `Request` and return a `Response`:
+
+```ts
+import { createLinkCardHandler } from "@aiquants/markdown/server"
+
+const linkCards = createLinkCardHandler({ authorize: () => true }) // a public site: every reader may ask
+
+export const handle = (request: Request): Promise<Response> =>
+    new URL(request.url).pathname === "/api/link-card" ? linkCards(request) : Promise.resolve(new Response(null, { status: 404 }))
+```
+
+The handler can also be called from inside another loader, for example a data route that dispatches several operations: it answers the request it is given.
+
+**Options.** `authorize: (request) => boolean | Promise<boolean>` is the only option, and it is required. Anything but `true` answers 401 before anything is fetched; a host that serves everyone passes `() => true`. It must only read the request — no cookie writes, no token refresh — because cards ask in the background and a request can still be in flight while the reader signs out. A rejection propagates to the host. `createLinkCardHandler` throws a `TypeError` when `authorize` is not a function and for any other option.
+
+**Answers.** Every answer carries `X-Content-Type-Options: nosniff` and never `Set-Cookie`; a `HEAD` answer has the `GET` answer's status and headers and no body.
+
+| Request | Status | Body | `Cache-Control` |
+| --- | --- | --- | --- |
+| A method other than `GET` and `HEAD` | 405 (with `Allow: GET, HEAD`) | `{"error":"Method Not Allowed"}` | `no-store` |
+| `authorize` does not return `true` | 401 | `{"error":"Unauthorized"}` | `no-store` |
+| No or an empty `url` | 400 | `{"error":"Missing 'url' parameter"}` | `no-store` |
+| A link that gets no card | 204 (with `X-Link-Card-Skip: <reason>`) | none | per reason, below |
+| An unexpected exception | 500 | `{"error":"Internal Server Error"}` | `no-store` |
+| A card | 200 | `{ title?, description?, site_name?, image?, icon? }` (`LinkCardResponseBody`) | `private, max-age=1800` |
+
+The JSON answers are `application/json; charset=utf-8`. The reasons of a 204:
+
+| Reason | When | `Cache-Control` |
+| --- | --- | --- |
+| `private-network` | The host is internal by name or by IP literal, it resolves to or connects to a private or special-use address, or a redirect leads to such a host | `private, max-age=1800` |
+| `forbidden-url` | The URL or a redirect target is not `http(s)`, carries a user name or password, or does not parse | `private, max-age=1800` |
+| `unreachable` | A network error, a timeout, a non-OK answer of the linked site, too many redirects or an unparsable `Location` | `private, max-age=300` |
+| `not-html` | The page's `Content-Type` is missing or not HTML | `private, max-age=300` |
+
+**Internal addresses never become cards**, in any environment; there is no switch. Internal is decided by address, never by the company's domain:
+
+- a loopback, private, link-local, CGNAT, multicast, documentation, benchmarking, discard-only or reserved IPv4 or IPv6 address (every IANA special-purpose range that is not globally reachable) written as the host, in every form the URL parser normalizes (`2130706433`, `0x7f.1`, `127.1`, `[::ffff:127.0.0.1]`, and the NAT64, 6to4, Teredo and IPv4-translated forms);
+- an internal name: `localhost`, `*.localhost`, a single-label name, one without a dot (the server's DNS search list would complete it to an internal name), and names under `.local`, `.internal` and `.home.arpa`, with or without a trailing dot;
+- a name that resolves to an internal address: every connection resolves through a lookup that refuses a name when any of its A or AAAA answers is private, and a `net.BlockList` (honoured by `net.connect` from Node 22.13, which `engines` requires) checks the very address connected to — for `https` too, whose TLS handshake runs over a TCP socket opened with the block list — so DNS rebinding cannot slip past;
+- every redirect hop, checked again before it is followed.
+
+**What the card shows.** The title is the last `og:title`, falling back to the first `<title>` of the document's head when that `og:title` is blank; the description is the last `og:description` or `<meta name="description">`; the site name the last `og:site_name`; the image the last `og:image`; the icon the first `<link rel>` holding the token `icon` (no `/favicon.ico` is guessed). A later blank `<meta>` clears an earlier one.
+Only the head is read: parsing stops at the first body content, skips the content of a `<noscript>`, `<template>` or `<noframes>` in the head as a browser with scripting does, and stops at an element nesting deeper than 256, after 4096 start tags and at a tag with more than 64 attributes, so a hostile page costs time and memory linear in the bytes read. Text is trimmed and cut at the card's limits (title 300, description 1000, site name 200 code points), so `linkCardMetadataOf` reads every body back unchanged.
+The image and the icon are resolved against the first `<base href>` — itself resolved against the page's URL, as a browser does, and used when it is `http(s)` and at most 2048 characters — else against the page's URL after redirects, and kept only when they are at most 2048 characters (`LINK_CARD_URL_LIMIT`) and the URL check accepts them.
+Only `text/html` and `application/xhtml+xml` answers are read, decoded by WHATWG encoding sniffing: a byte order mark, then the `charset` of `Content-Type`, then a `<meta charset>` or `<meta http-equiv="Content-Type">` in the first 1024 bytes, else UTF-8 (Shift_JIS, EUC-JP, ISO-2022-JP and every other label `TextDecoder` knows; an unknown label is ignored).
+
+**Limits.** 5 s per page for the headers, the body and its parsing; 5 redirects, each followed by hand and checked again; 64 KiB of response headers; at most the first 8 MiB of the body, read as a stream and parsed as it arrives, yielding to the event loop between chunks, and the download stops once the head has been read.
+DNS goes through c-ares, never through `getaddrinfo` on libuv's threadpool, so a name whose DNS never answers holds none of the threads the host's `fs`, `zlib` and `crypto` share: A and AAAA queries to the DNS servers of the system's resolver configuration (the hosts file is not read), 1 s for the first attempt and 2 attempts per server; a name connects over IPv4 when it has an A record, else over IPv6.
+Each handler caches cards per URL for 1 hour and skips as long as their `Cache-Control`, 1000 URLs at most; the key is the URL as the URL parser serializes it without its fragment, so spellings of one URL share one entry, and concurrent requests for one URL share one fetch.
+
+**Logs.** The handler logs through the package's logger, never with a URL's user name or password (a refused URL that is not `http(s)` is logged by its scheme alone): policy refusals (`private-network`, `forbidden-url`) at info, network errors, unparsable `Location`s, too many redirects and unexpected exceptions at error, and a body cut at the size limit at warn.
+
 ### Links
 
 - A link is external when its `href` names a scheme in any case (`https:`, `HTTPS:`, `mailto:`) or another host (`//host/…`, `/\host/…`), whatever its `data-link-kind` says, and when `data-link-kind` is `external`. An external link opens in a new tab with `rel="noreferrer"` and is never handed to `linkComponent`. The author's `target` and `rel` never survive.
@@ -279,7 +417,8 @@ An open, unpinned popover closes on Escape while the focus is inside its menu, r
 
 Activating an entry closes an unpinned table of contents, reveals the heading if it is hidden, scrolls to it (instantly under `prefers-reduced-motion: reduce`) and moves the focus to it (adding `tabindex="-1"` when the heading has none), so the next Tab continues from that section. Pass `onHeadingSelect(heading, event)` to take part: return `false` to let the viewer reveal, scroll and focus after your own work (writing the URL hash, say), or `true` when you have handled the navigation yourself.
 
-An entry links to `#` followed by the heading's id. Where the page's URL does not address the document (several documents side by side, a document chosen by state), pass `headingHref(heading)` (`MarkdownHeadingHrefResolver`) to give each entry the heading's own address, so copying the entry's address or opening it in a new tab with a middle click reaches the heading; pass a stable function, since the table of contents is built again when it changes.
+The entry of a heading without an id (`# ★`, whose text keeps no character) is its text alone, not a link: no fragment names that heading, so neither `headingHref` nor `onHeadingSelect` is called for it.
+Any other entry links to `#` followed by the heading's id. Where the page's URL does not address the document (several documents side by side, a document chosen by state), pass `headingHref(heading)` (`MarkdownHeadingHrefResolver`) to give each entry the heading's own address, so copying the entry's address or opening it in a new tab with a middle click reaches the heading; pass a stable function, since the table of contents is built again when it changes.
 The href goes through the package's URL rule (an entry with a refused href has none), and activating an entry still runs `onHeadingSelect` and the viewer's navigation. A Ctrl-, Cmd- or Shift-click is an activation, so return `true` from `onHeadingSelect` when a modifier key is down to let the browser open the address instead.
 
 The viewer stops the link's own navigation, so it reveals the heading the way a browser reveals the fragment it navigates to:
@@ -313,7 +452,7 @@ const headingHref: MarkdownHeadingHrefResolver = (heading) => `/docs/guide.md#${
 
 Every name and text the viewer draws comes from `labels` (`MarkdownViewerLabels`), including the table-of-contents and alignment controls and, through the `mermaid*` keys, the controls of each Mermaid diagram (`MermaidDiagram` takes `MermaidDiagramLabels` as `labels`).
 A label you pass carries no language of its own and is read in your page's language.
-A built-in label marks the element that bears it with its own language: the status texts and style controls are English (`lang="en"`), the table-of-contents, alignment and Mermaid menu controls are Japanese (`lang="ja"`), and the Mermaid zoom buttons are English. `DEFAULT_MARKDOWN_VIEWER_LABELS` and `DEFAULT_MERMAID_DIAGRAM_LABELS` hold the built-in texts.
+A built-in label marks the element that bears it with its own language: the status texts and style controls are English (`lang="en"`), the table-of-contents, alignment and Mermaid menu controls are Japanese (`lang="ja"`), and the Mermaid zoom buttons are English. The embed labels (`embeddedVideo`, `embeddedPost`, `embeddedFrame`) are English. `DEFAULT_MARKDOWN_VIEWER_LABELS`, `DEFAULT_MERMAID_DIAGRAM_LABELS` and `DEFAULT_MARKDOWN_EMBED_LABELS` hold the built-in texts.
 
 ### Settings without React
 
@@ -327,6 +466,29 @@ import { DEFAULT_MARKDOWN_STYLES, toContentAlign } from "@aiquants/markdown/view
 
 The parser supports the following extended markdown syntax in addition to CommonMark and GFM.
 
+### Heading ids
+
+The converter gives every heading its id; `MarkdownViewer` and `MarkdownRenderer` render the ids of the HTML and assign none.
+
+- **Written id**: end the heading's last line with `{#id}`, or with `{id="…"}` when the id holds a space or ASCII punctuation other than `_`, `-`, `:` and `.` (a `}`, say). `## 概要 {#overview}` gets the id `overview`.
+  - It is kept exactly as written, in any script.
+  - No automatic id takes it, wherever the heading is.
+  - When two headings write the same id, both keep it and a fragment names the first.
+  - An id attribute that names nothing — empty (`{#}`, `{id=""}`) or not a string (`{id=123}`) — is removed, and the heading gets its automatic id.
+- **Automatic id**: GitHub's, as github-slugger 2.0.0 makes it from the heading's text:
+  - lower-cased;
+  - punctuation and symbols removed;
+  - letters, marks, digits, `_` and `-` of every script kept;
+  - each space becomes `-`;
+  - a repeated id gets `-1`, `-2`, ….
+  - Examples: `概要` → `概要`, `API の使い方` → `api-の使い方`, `Step 2: Install` → `step-2-install`, a second `重複` → `重複-1`.
+  - A heading whose text keeps no character (`★`) has no id, its `ParseResult.headings[].id` is `""`, and its table-of-contents entry is plain text, not a link.
+  - The text is the heading's text as GitHub reads it: no Typographer substitution (`A -- B` → `a----b`), white space as written, an image's alt and raw HTML left out. The spaces and tabs before an ATX closing sequence or a `{…}` block are not text (`# Title  ##` → `title`).
+  - Where the converter parses a construct differently from GitHub, the id follows the converter's rendering: `$ x $` (text here, a formula on GitHub), the number of a footnote referenced from inside another note, a code span continued on an indented line, `<<x>>`, Zenn directives and definition lists.
+- **Anchors in raw HTML**: the viewer keeps `<a name="…">` and ids starting with `user-content-`. `<a id="user-content-faq"></a>` is reached by `#user-content-faq`. It removes any other author id (see [Raw HTML](#raw-html)).
+
+Links written for GitHub or VS Code (`[概要へ](#概要)`, `[使い方](#api-の使い方)`) land on the heading.
+
 ### LaTeX Math Expressions
 
 - Inline math: `$y=x^2$`. A single `$` follows the `tex_math_dollars` rule of Pandoc 3.12: the opening `$` must be followed by a character that is not white space, and the formula ends at the first `$` after it that is not escaped by `\` and not inside a `\text{…}` group whose braces close; that `$` must follow a character that is not white space (a character escaped by `\`, such as the space in `$a\ $`, is not) and must not be followed by an ASCII digit; otherwise the `$` stays text.

package/dist/{abnfDiagram-VRR7QNED-DeHJ63Vu.js → abnfDiagram-VRR7QNED-0ow9i3L-.js}

@@ -1,6 +1,6 @@
-import { g as p, r as u, d as a } from "./chunk-MOJQB5TN-D_h6bolU.js";
-import { p as f } from "./chunk-JWPE2WC7-DpcSSOP5.js";
-import { _ as n, $ as o } from "./extractHeadings-CGJexznE.js";
+import { g as p, r as u, d as a } from "./chunk-MOJQB5TN-1pZNp2Wl.js";
+import { p as f } from "./chunk-JWPE2WC7-Djg6Qi23.js";
+import { _ as n, O as o } from "./extractHeadings-CtiYkq2z.js";
 import { M as c, b as d } from "./cynefin-VYW2F7L2-Bkk-F_Js.js";
 var v = d().RailroadAbnf.parser.LangiumParser, i = /* @__PURE__ */ n((e) => {
   const r = e.alternatives.map(g);

package/dist/{abnfDiagram-VRR7QNED-CfVjEUzG.cjs → abnfDiagram-VRR7QNED-DRNsVB-u.cjs}

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("./chunk-MOJQB5TN-Cw864mUL.cjs"),u=require("./chunk-JWPE2WC7-5cM5nFf6.cjs"),n=require("./extractHeadings-lDHB2sBb.cjs"),i=require("./cynefin-VYW2F7L2-MpAliYy9.cjs");var p=i.createRailroadAbnfServices().RailroadAbnf.parser.LangiumParser,o=n.__name(e=>{const r=e.alternatives.map(c);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),c=n.__name(e=>{const r=e.elements.map(d);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),f=n.__name(e=>{if(e.includes("*")){const[t,s]=e.split("*"),l=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:l,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),d=n.__name(e=>{const r=b(e.primary);if(!e.repeat)return r;const{min:t,max:s}=f(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),b=n.__name(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return o(e.element);case"AbnfOptionalGroup":return{type:"optional",element:o(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),g=n.__name(e=>({name:e.name,definition:o(e.definition)}),"transformRule"),v=n.__name(e=>{u.populateCommonDb(e,a.db),e.title&&a.db.setTitle(e.title),e.rules.map(r=>a.db.addRule(g(r)))},"populateDb"),y={parse:n.__name(e=>{a.db.clear(),n.log.debug("[ABNF Parser] Starting Langium parse");const r=p.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new i.MermaidParseError(r);const t=r.value;n.log.debug("[ABNF Parser] Parsed rules:",t.rules.length),v(t),n.log.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a.db}},_={parser:y,db:a.db,renderer:a.renderer,styles:a.getStyles};exports.diagram=_;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const a=require("./chunk-MOJQB5TN-DUk2Jy4_.cjs"),u=require("./chunk-JWPE2WC7-Bz9dXsLZ.cjs"),n=require("./extractHeadings-D1A8WzVy.cjs"),i=require("./cynefin-VYW2F7L2-MpAliYy9.cjs");var p=i.createRailroadAbnfServices().RailroadAbnf.parser.LangiumParser,o=n.__name(e=>{const r=e.alternatives.map(c);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),c=n.__name(e=>{const r=e.elements.map(d);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),f=n.__name(e=>{if(e.includes("*")){const[t,s]=e.split("*"),l=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:l,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),d=n.__name(e=>{const r=b(e.primary);if(!e.repeat)return r;const{min:t,max:s}=f(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),b=n.__name(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return o(e.element);case"AbnfOptionalGroup":return{type:"optional",element:o(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),g=n.__name(e=>({name:e.name,definition:o(e.definition)}),"transformRule"),v=n.__name(e=>{u.populateCommonDb(e,a.db),e.title&&a.db.setTitle(e.title),e.rules.map(r=>a.db.addRule(g(r)))},"populateDb"),y={parse:n.__name(e=>{a.db.clear(),n.log.debug("[ABNF Parser] Starting Langium parse");const r=p.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new i.MermaidParseError(r);const t=r.value;n.log.debug("[ABNF Parser] Parsed rules:",t.rules.length),v(t),n.log.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a.db}},_={parser:y,db:a.db,renderer:a.renderer,styles:a.getStyles};exports.diagram=_;

package/dist/{arc-XFFLkHkK.cjs → arc-BWR9_qMf.cjs}

@@ -1 +1 @@
-"use strict";const n=require("./extractHeadings-lDHB2sBb.cjs");function $(o){return o.innerRadius}function b(o){return o.outerRadius}function k(o){return o.startAngle}function _(o){return o.endAngle}function nn(o){return o&&o.padAngle}function en(o,x,D,P,h,v,S,s){var E=D-o,r=P-x,e=S-h,p=s-v,i=p*E-e*r;if(!(i*i<n.epsilon))return i=(e*(x-v)-p*(o-h))/i,[o+i*E,x+i*r]}function M(o,x,D,P,h,v,S){var s=o-D,E=x-P,r=(S?v:-v)/n.sqrt(s*s+E*E),e=r*E,p=-r*s,i=o+e,u=x+p,c=D+e,f=P+p,j=(i+c)/2,l=(u+f)/2,y=c-i,g=f-u,A=y*y+g*g,R=h-v,T=i*f-c*u,H=(g<0?-1:1)*n.sqrt(n.max(0,R*R*A-T*T)),I=(T*g-y*H)/A,O=(-T*y-g*H)/A,q=(T*g+y*H)/A,d=(-T*y+g*H)/A,m=I-j,a=O-l,t=q-j,z=d-l;return m*m+a*a>t*t+z*z&&(I=q,O=d),{cx:I,cy:O,x01:-e,y01:-p,x11:I*(h/R-1),y11:O*(h/R-1)}}function an(){var o=$,x=b,D=n.constant(0),P=null,h=k,v=_,S=nn,s=null,E=n.withPath(r);function r(){var e,p,i=+o.apply(this,arguments),u=+x.apply(this,arguments),c=h.apply(this,arguments)-n.halfPi,f=v.apply(this,arguments)-n.halfPi,j=n.abs(f-c),l=f>c;if(s||(s=e=E()),u<i&&(p=u,u=i,i=p),!(u>n.epsilon))s.moveTo(0,0);else if(j>n.tau-n.epsilon)s.moveTo(u*n.cos(c),u*n.sin(c)),s.arc(0,0,u,c,f,!l),i>n.epsilon&&(s.moveTo(i*n.cos(f),i*n.sin(f)),s.arc(0,0,i,f,c,l));else{var y=c,g=f,A=c,R=f,T=j,H=j,I=S.apply(this,arguments)/2,O=I>n.epsilon&&(P?+P.apply(this,arguments):n.sqrt(i*i+u*u)),q=n.min(n.abs(u-i)/2,+D.apply(this,arguments)),d=q,m=q,a,t;if(O>n.epsilon){var z=n.asin(O/i*n.sin(I)),F=n.asin(O/u*n.sin(I));(T-=z*2)>n.epsilon?(z*=l?1:-1,A+=z,R-=z):(T=0,A=R=(c+f)/2),(H-=F*2)>n.epsilon?(F*=l?1:-1,y+=F,g-=F):(H=0,y=g=(c+f)/2)}var B=u*n.cos(y),C=u*n.sin(y),G=i*n.cos(R),J=i*n.sin(R);if(q>n.epsilon){var K=u*n.cos(g),L=u*n.sin(g),N=i*n.cos(A),Q=i*n.sin(A),w;if(j<n.pi)if(w=en(B,C,N,Q,K,L,G,J)){var U=B-w[0],V=C-w[1],W=K-w[0],X=L-w[1],Y=1/n.sin(n.acos((U*W+V*X)/(n.sqrt(U*U+V*V)*n.sqrt(W*W+X*X)))/2),Z=n.sqrt(w[0]*w[0]+w[1]*w[1]);d=n.min(q,(i-Z)/(Y-1)),m=n.min(q,(u-Z)/(Y+1))}else d=m=0}H>n.epsilon?m>n.epsilon?(a=M(N,Q,B,C,u,m,l),t=M(K,L,G,J,u,m,l),s.moveTo(a.cx+a.x01,a.cy+a.y01),m<q?s.arc(a.cx,a.cy,m,n.atan2(a.y01,a.x01),n.atan2(t.y01,t.x01),!l):(s.arc(a.cx,a.cy,m,n.atan2(a.y01,a.x01),n.atan2(a.y11,a.x11),!l),s.arc(0,0,u,n.atan2(a.cy+a.y11,a.cx+a.x11),n.atan2(t.cy+t.y11,t.cx+t.x11),!l),s.arc(t.cx,t.cy,m,n.atan2(t.y11,t.x11),n.atan2(t.y01,t.x01),!l))):(s.moveTo(B,C),s.arc(0,0,u,y,g,!l)):s.moveTo(B,C),!(i>n.epsilon)||!(T>n.epsilon)?s.lineTo(G,J):d>n.epsilon?(a=M(G,J,K,L,i,-d,l),t=M(B,C,N,Q,i,-d,l),s.lineTo(a.cx+a.x01,a.cy+a.y01),d<q?s.arc(a.cx,a.cy,d,n.atan2(a.y01,a.x01),n.atan2(t.y01,t.x01),!l):(s.arc(a.cx,a.cy,d,n.atan2(a.y01,a.x01),n.atan2(a.y11,a.x11),!l),s.arc(0,0,i,n.atan2(a.cy+a.y11,a.cx+a.x11),n.atan2(t.cy+t.y11,t.cx+t.x11),l),s.arc(t.cx,t.cy,d,n.atan2(t.y11,t.x11),n.atan2(t.y01,t.x01),!l))):s.arc(0,0,i,R,A,l)}if(s.closePath(),e)return s=null,e+""||null}return r.centroid=function(){var e=(+o.apply(this,arguments)+ +x.apply(this,arguments))/2,p=(+h.apply(this,arguments)+ +v.apply(this,arguments))/2-n.pi/2;return[n.cos(p)*e,n.sin(p)*e]},r.innerRadius=function(e){return arguments.length?(o=typeof e=="function"?e:n.constant(+e),r):o},r.outerRadius=function(e){return arguments.length?(x=typeof e=="function"?e:n.constant(+e),r):x},r.cornerRadius=function(e){return arguments.length?(D=typeof e=="function"?e:n.constant(+e),r):D},r.padRadius=function(e){return arguments.length?(P=e==null?null:typeof e=="function"?e:n.constant(+e),r):P},r.startAngle=function(e){return arguments.length?(h=typeof e=="function"?e:n.constant(+e),r):h},r.endAngle=function(e){return arguments.length?(v=typeof e=="function"?e:n.constant(+e),r):v},r.padAngle=function(e){return arguments.length?(S=typeof e=="function"?e:n.constant(+e),r):S},r.context=function(e){return arguments.length?(s=e??null,r):s},r}exports.d3arc=an;
+"use strict";const n=require("./extractHeadings-D1A8WzVy.cjs");function $(o){return o.innerRadius}function b(o){return o.outerRadius}function k(o){return o.startAngle}function _(o){return o.endAngle}function nn(o){return o&&o.padAngle}function en(o,x,D,P,h,v,S,s){var E=D-o,r=P-x,e=S-h,p=s-v,i=p*E-e*r;if(!(i*i<n.epsilon))return i=(e*(x-v)-p*(o-h))/i,[o+i*E,x+i*r]}function M(o,x,D,P,h,v,S){var s=o-D,E=x-P,r=(S?v:-v)/n.sqrt(s*s+E*E),e=r*E,p=-r*s,i=o+e,u=x+p,c=D+e,f=P+p,j=(i+c)/2,l=(u+f)/2,y=c-i,g=f-u,A=y*y+g*g,R=h-v,T=i*f-c*u,H=(g<0?-1:1)*n.sqrt(n.max(0,R*R*A-T*T)),I=(T*g-y*H)/A,O=(-T*y-g*H)/A,q=(T*g+y*H)/A,d=(-T*y+g*H)/A,m=I-j,a=O-l,t=q-j,z=d-l;return m*m+a*a>t*t+z*z&&(I=q,O=d),{cx:I,cy:O,x01:-e,y01:-p,x11:I*(h/R-1),y11:O*(h/R-1)}}function an(){var o=$,x=b,D=n.constant(0),P=null,h=k,v=_,S=nn,s=null,E=n.withPath(r);function r(){var e,p,i=+o.apply(this,arguments),u=+x.apply(this,arguments),c=h.apply(this,arguments)-n.halfPi,f=v.apply(this,arguments)-n.halfPi,j=n.abs(f-c),l=f>c;if(s||(s=e=E()),u<i&&(p=u,u=i,i=p),!(u>n.epsilon))s.moveTo(0,0);else if(j>n.tau-n.epsilon)s.moveTo(u*n.cos(c),u*n.sin(c)),s.arc(0,0,u,c,f,!l),i>n.epsilon&&(s.moveTo(i*n.cos(f),i*n.sin(f)),s.arc(0,0,i,f,c,l));else{var y=c,g=f,A=c,R=f,T=j,H=j,I=S.apply(this,arguments)/2,O=I>n.epsilon&&(P?+P.apply(this,arguments):n.sqrt(i*i+u*u)),q=n.min(n.abs(u-i)/2,+D.apply(this,arguments)),d=q,m=q,a,t;if(O>n.epsilon){var z=n.asin(O/i*n.sin(I)),F=n.asin(O/u*n.sin(I));(T-=z*2)>n.epsilon?(z*=l?1:-1,A+=z,R-=z):(T=0,A=R=(c+f)/2),(H-=F*2)>n.epsilon?(F*=l?1:-1,y+=F,g-=F):(H=0,y=g=(c+f)/2)}var B=u*n.cos(y),C=u*n.sin(y),G=i*n.cos(R),J=i*n.sin(R);if(q>n.epsilon){var K=u*n.cos(g),L=u*n.sin(g),N=i*n.cos(A),Q=i*n.sin(A),w;if(j<n.pi)if(w=en(B,C,N,Q,K,L,G,J)){var U=B-w[0],V=C-w[1],W=K-w[0],X=L-w[1],Y=1/n.sin(n.acos((U*W+V*X)/(n.sqrt(U*U+V*V)*n.sqrt(W*W+X*X)))/2),Z=n.sqrt(w[0]*w[0]+w[1]*w[1]);d=n.min(q,(i-Z)/(Y-1)),m=n.min(q,(u-Z)/(Y+1))}else d=m=0}H>n.epsilon?m>n.epsilon?(a=M(N,Q,B,C,u,m,l),t=M(K,L,G,J,u,m,l),s.moveTo(a.cx+a.x01,a.cy+a.y01),m<q?s.arc(a.cx,a.cy,m,n.atan2(a.y01,a.x01),n.atan2(t.y01,t.x01),!l):(s.arc(a.cx,a.cy,m,n.atan2(a.y01,a.x01),n.atan2(a.y11,a.x11),!l),s.arc(0,0,u,n.atan2(a.cy+a.y11,a.cx+a.x11),n.atan2(t.cy+t.y11,t.cx+t.x11),!l),s.arc(t.cx,t.cy,m,n.atan2(t.y11,t.x11),n.atan2(t.y01,t.x01),!l))):(s.moveTo(B,C),s.arc(0,0,u,y,g,!l)):s.moveTo(B,C),!(i>n.epsilon)||!(T>n.epsilon)?s.lineTo(G,J):d>n.epsilon?(a=M(G,J,K,L,i,-d,l),t=M(B,C,N,Q,i,-d,l),s.lineTo(a.cx+a.x01,a.cy+a.y01),d<q?s.arc(a.cx,a.cy,d,n.atan2(a.y01,a.x01),n.atan2(t.y01,t.x01),!l):(s.arc(a.cx,a.cy,d,n.atan2(a.y01,a.x01),n.atan2(a.y11,a.x11),!l),s.arc(0,0,i,n.atan2(a.cy+a.y11,a.cx+a.x11),n.atan2(t.cy+t.y11,t.cx+t.x11),l),s.arc(t.cx,t.cy,d,n.atan2(t.y11,t.x11),n.atan2(t.y01,t.x01),!l))):s.arc(0,0,i,R,A,l)}if(s.closePath(),e)return s=null,e+""||null}return r.centroid=function(){var e=(+o.apply(this,arguments)+ +x.apply(this,arguments))/2,p=(+h.apply(this,arguments)+ +v.apply(this,arguments))/2-n.pi/2;return[n.cos(p)*e,n.sin(p)*e]},r.innerRadius=function(e){return arguments.length?(o=typeof e=="function"?e:n.constant(+e),r):o},r.outerRadius=function(e){return arguments.length?(x=typeof e=="function"?e:n.constant(+e),r):x},r.cornerRadius=function(e){return arguments.length?(D=typeof e=="function"?e:n.constant(+e),r):D},r.padRadius=function(e){return arguments.length?(P=e==null?null:typeof e=="function"?e:n.constant(+e),r):P},r.startAngle=function(e){return arguments.length?(h=typeof e=="function"?e:n.constant(+e),r):h},r.endAngle=function(e){return arguments.length?(v=typeof e=="function"?e:n.constant(+e),r):v},r.padAngle=function(e){return arguments.length?(S=typeof e=="function"?e:n.constant(+e),r):S},r.context=function(e){return arguments.length?(s=e??null,r):s},r}exports.d3arc=an;

package/dist/arc-Bh12k776.js

@@ -0,0 +1,83 @@
+import { aC as ln, aD as an, aE as y, aF as tn, aG as M, aH as D, aI as _, aJ as un, aK as rn, aL as S, aM as o, aN as H, aO as sn, aP as on, aQ as fn } from "./extractHeadings-CtiYkq2z.js";
+function cn(l) {
+  return l.innerRadius;
+}
+function yn(l) {
+  return l.outerRadius;
+}
+function gn(l) {
+  return l.startAngle;
+}
+function dn(l) {
+  return l.endAngle;
+}
+function mn(l) {
+  return l && l.padAngle;
+}
+function pn(l, h, O, E, v, A, J, a) {
+  var q = O - l, i = E - h, n = J - v, d = a - A, u = d * q - n * i;
+  if (!(u * u < y))
+    return u = (n * (h - A) - d * (l - v)) / u, [l + u * q, h + u * i];
+}
+function W(l, h, O, E, v, A, J) {
+  var a = l - O, q = h - E, i = (J ? A : -A) / S(a * a + q * q), n = i * q, d = -i * a, u = l + n, s = h + d, f = O + n, c = E + d, K = (u + f) / 2, t = (s + c) / 2, m = f - u, g = c - s, R = m * m + g * g, T = v - A, P = u * c - f * s, C = (g < 0 ? -1 : 1) * S(fn(0, T * T * R - P * P)), F = (P * g - m * C) / R, G = (-P * m - g * C) / R, w = (P * g + m * C) / R, p = (-P * m + g * C) / R, x = F - K, e = G - t, r = w - K, L = p - t;
+  return x * x + e * e > r * r + L * L && (F = w, G = p), {
+    cx: F,
+    cy: G,
+    x01: -n,
+    y01: -d,
+    x11: F * (v / T - 1),
+    y11: G * (v / T - 1)
+  };
+}
+function hn() {
+  var l = cn, h = yn, O = H(0), E = null, v = gn, A = dn, J = mn, a = null, q = ln(i);
+  function i() {
+    var n, d, u = +l.apply(this, arguments), s = +h.apply(this, arguments), f = v.apply(this, arguments) - an, c = A.apply(this, arguments) - an, K = un(c - f), t = c > f;
+    if (a || (a = n = q()), s < u && (d = s, s = u, u = d), !(s > y)) a.moveTo(0, 0);
+    else if (K > tn - y)
+      a.moveTo(s * M(f), s * D(f)), a.arc(0, 0, s, f, c, !t), u > y && (a.moveTo(u * M(c), u * D(c)), a.arc(0, 0, u, c, f, t));
+    else {
+      var m = f, g = c, R = f, T = c, P = K, C = K, F = J.apply(this, arguments) / 2, G = F > y && (E ? +E.apply(this, arguments) : S(u * u + s * s)), w = _(un(s - u) / 2, +O.apply(this, arguments)), p = w, x = w, e, r;
+      if (G > y) {
+        var L = sn(G / u * D(F)), j = sn(G / s * D(F));
+        (P -= L * 2) > y ? (L *= t ? 1 : -1, R += L, T -= L) : (P = 0, R = T = (f + c) / 2), (C -= j * 2) > y ? (j *= t ? 1 : -1, m += j, g -= j) : (C = 0, m = g = (f + c) / 2);
+      }
+      var N = s * M(m), Q = s * D(m), z = u * M(T), B = u * D(T);
+      if (w > y) {
+        var U = s * M(g), V = s * D(g), X = u * M(R), Y = u * D(R), I;
+        if (K < rn)
+          if (I = pn(N, Q, X, Y, U, V, z, B)) {
+            var Z = N - I[0], $ = Q - I[1], k = U - I[0], b = V - I[1], nn = 1 / D(on((Z * k + $ * b) / (S(Z * Z + $ * $) * S(k * k + b * b))) / 2), en = S(I[0] * I[0] + I[1] * I[1]);
+            p = _(w, (u - en) / (nn - 1)), x = _(w, (s - en) / (nn + 1));
+          } else
+            p = x = 0;
+      }
+      C > y ? x > y ? (e = W(X, Y, N, Q, s, x, t), r = W(U, V, z, B, s, x, t), a.moveTo(e.cx + e.x01, e.cy + e.y01), x < w ? a.arc(e.cx, e.cy, x, o(e.y01, e.x01), o(r.y01, r.x01), !t) : (a.arc(e.cx, e.cy, x, o(e.y01, e.x01), o(e.y11, e.x11), !t), a.arc(0, 0, s, o(e.cy + e.y11, e.cx + e.x11), o(r.cy + r.y11, r.cx + r.x11), !t), a.arc(r.cx, r.cy, x, o(r.y11, r.x11), o(r.y01, r.x01), !t))) : (a.moveTo(N, Q), a.arc(0, 0, s, m, g, !t)) : a.moveTo(N, Q), !(u > y) || !(P > y) ? a.lineTo(z, B) : p > y ? (e = W(z, B, U, V, u, -p, t), r = W(N, Q, X, Y, u, -p, t), a.lineTo(e.cx + e.x01, e.cy + e.y01), p < w ? a.arc(e.cx, e.cy, p, o(e.y01, e.x01), o(r.y01, r.x01), !t) : (a.arc(e.cx, e.cy, p, o(e.y01, e.x01), o(e.y11, e.x11), !t), a.arc(0, 0, u, o(e.cy + e.y11, e.cx + e.x11), o(r.cy + r.y11, r.cx + r.x11), t), a.arc(r.cx, r.cy, p, o(r.y11, r.x11), o(r.y01, r.x01), !t))) : a.arc(0, 0, u, T, R, t);
+    }
+    if (a.closePath(), n) return a = null, n + "" || null;
+  }
+  return i.centroid = function() {
+    var n = (+l.apply(this, arguments) + +h.apply(this, arguments)) / 2, d = (+v.apply(this, arguments) + +A.apply(this, arguments)) / 2 - rn / 2;
+    return [M(d) * n, D(d) * n];
+  }, i.innerRadius = function(n) {
+    return arguments.length ? (l = typeof n == "function" ? n : H(+n), i) : l;
+  }, i.outerRadius = function(n) {
+    return arguments.length ? (h = typeof n == "function" ? n : H(+n), i) : h;
+  }, i.cornerRadius = function(n) {
+    return arguments.length ? (O = typeof n == "function" ? n : H(+n), i) : O;
+  }, i.padRadius = function(n) {
+    return arguments.length ? (E = n == null ? null : typeof n == "function" ? n : H(+n), i) : E;
+  }, i.startAngle = function(n) {
+    return arguments.length ? (v = typeof n == "function" ? n : H(+n), i) : v;
+  }, i.endAngle = function(n) {
+    return arguments.length ? (A = typeof n == "function" ? n : H(+n), i) : A;
+  }, i.padAngle = function(n) {
+    return arguments.length ? (J = typeof n == "function" ? n : H(+n), i) : J;
+  }, i.context = function(n) {
+    return arguments.length ? (a = n ?? null, i) : a;
+  }, i;
+}
+export {
+  hn as d
+};