@fuzdev/fuz_ui 0.198.1 → 0.199.0

package/dist/mdz_helpers.js

@@ -51,6 +51,47 @@ export const MIN_CODEBLOCK_BACKTICKS = 3; // Code blocks require minimum 3 backt
 export const MAX_HEADING_LEVEL = 6; // Headings support levels 1-6
 export const HTTPS_PREFIX_LENGTH = 8; // Length of "https://"
 export const HTTP_PREFIX_LENGTH = 7; // Length of "http://"
+export const H_LOWER = 104; // h
+export const H_UPPER = 72; // H
+/**
+ * Lowercase an ASCII letter code; passes other chars through.
+ * Mirrors the `[A-Z] → [a-z]` shift without touching non-ASCII.
+ */
+export const ascii_to_lower = (char_code) => char_code >= A_UPPER && char_code <= Z_UPPER ? char_code + 32 : char_code;
+/**
+ * Case-insensitive URL scheme prefix check. Returns the prefix length
+ * (8 for `https://`, 7 for `http://`) or 0 if neither matches at `pos`.
+ *
+ * URI schemes are case-insensitive per RFC 3986 §3.1, and mobile keyboards
+ * routinely auto-capitalize the first letter of a sentence, producing
+ * `Https://` etc. The original case is preserved in the emitted reference —
+ * browsers normalize schemes themselves.
+ */
+export const match_url_prefix_case_insensitive = (s, pos) => {
+    if (pos + HTTP_PREFIX_LENGTH > s.length)
+        return 0;
+    // h | H
+    if (ascii_to_lower(s.charCodeAt(pos)) !== H_LOWER)
+        return 0;
+    // 'ttps://' (7 chars) or 'ttp://' (6 chars)
+    if (ascii_to_lower(s.charCodeAt(pos + 1)) === 116 /* t */ &&
+        ascii_to_lower(s.charCodeAt(pos + 2)) === 116 /* t */ &&
+        ascii_to_lower(s.charCodeAt(pos + 3)) === 112 /* p */) {
+        if (pos + HTTPS_PREFIX_LENGTH <= s.length &&
+            ascii_to_lower(s.charCodeAt(pos + 4)) === 115 /* s */ &&
+            s.charCodeAt(pos + 5) === COLON &&
+            s.charCodeAt(pos + 6) === SLASH &&
+            s.charCodeAt(pos + 7) === SLASH) {
+            return HTTPS_PREFIX_LENGTH;
+        }
+        if (s.charCodeAt(pos + 4) === COLON &&
+            s.charCodeAt(pos + 5) === SLASH &&
+            s.charCodeAt(pos + 6) === SLASH) {
+            return HTTP_PREFIX_LENGTH;
+        }
+    }
+    return 0;
+};
 /**
  * Check if character code is a letter (A-Z, a-z).
  */
@@ -66,22 +107,19 @@ export const is_tag_name_char = (char_code) => is_letter(char_code) ||
  * Check if character is part of a word for word boundary detection.
  * Used to prevent intraword emphasis with `_` and `~` delimiters.
  *
- * Formatting delimiters (`*`, `_`, `~`) are NOT word characters - they're transparent.
- * Only alphanumeric characters (A-Z, a-z, 0-9) are considered word characters.
+ * Only alphanumeric characters (A-Z, a-z, 0-9) are word characters.
+ * Formatting delimiters (`*`, `_`, `~`) fall outside all three ranges,
+ * so they're naturally excluded without explicit checks.
  *
  * This prevents false positives with snake_case identifiers while allowing
  * adjacent formatting like `**bold**_italic_`.
  */
-export const is_word_char = (char_code) => {
-    if (char_code === ASTERISK || char_code === UNDERSCORE || char_code === TILDE)
-        return false;
-    return ((char_code >= A_UPPER && char_code <= Z_UPPER) ||
-        (char_code >= A_LOWER && char_code <= Z_LOWER) ||
-        (char_code >= ZERO && char_code <= NINE));
-};
+export const is_word_char = (char_code) => (char_code >= A_UPPER && char_code <= Z_UPPER) ||
+    (char_code >= A_LOWER && char_code <= Z_LOWER) ||
+    (char_code >= ZERO && char_code <= NINE);
 /**
- * Check if character code is valid in URI path per RFC 3986.
- * Validates against the `pchar` production plus path/query/fragment separators.
+ * Lookup table for valid URI path characters per RFC 3986.
+ * Replaces a 16-comparison chain with a single array access.
  *
  * Valid characters:
  * - unreserved: A-Z a-z 0-9 - . _ ~
@@ -90,41 +128,59 @@ export const is_word_char = (char_code) => {
  * - separators: / ? #
  * - percent-encoding: %
  */
-export const is_valid_path_char = (char_code) => (char_code >= A_UPPER && char_code <= Z_UPPER) ||
-    (char_code >= A_LOWER && char_code <= Z_LOWER) ||
-    (char_code >= ZERO && char_code <= NINE) ||
-    char_code === HYPHEN ||
-    char_code === PERIOD ||
-    char_code === UNDERSCORE ||
-    char_code === TILDE ||
-    char_code === EXCLAMATION ||
-    char_code === DOLLAR ||
-    char_code === AMPERSAND ||
-    char_code === APOSTROPHE ||
-    char_code === LEFT_PAREN ||
-    char_code === RIGHT_PAREN ||
-    char_code === ASTERISK ||
-    char_code === PLUS ||
-    char_code === COMMA ||
-    char_code === SEMICOLON ||
-    char_code === EQUALS ||
-    char_code === COLON ||
-    char_code === AT ||
-    char_code === SLASH ||
-    char_code === QUESTION ||
-    char_code === HASH ||
-    char_code === PERCENT;
+const PATH_CHAR_TABLE = (() => {
+    const t = new Uint8Array(128);
+    for (let i = A_UPPER; i <= Z_UPPER; i++)
+        t[i] = 1;
+    for (let i = A_LOWER; i <= Z_LOWER; i++)
+        t[i] = 1;
+    for (let i = ZERO; i <= NINE; i++)
+        t[i] = 1;
+    // unreserved: - . _ ~
+    t[HYPHEN] = 1;
+    t[PERIOD] = 1;
+    t[UNDERSCORE] = 1;
+    t[TILDE] = 1;
+    // sub-delims: ! $ & ' ( ) * + , ; =
+    t[EXCLAMATION] = 1;
+    t[DOLLAR] = 1;
+    t[AMPERSAND] = 1;
+    t[APOSTROPHE] = 1;
+    t[LEFT_PAREN] = 1;
+    t[RIGHT_PAREN] = 1;
+    t[ASTERISK] = 1;
+    t[PLUS] = 1;
+    t[COMMA] = 1;
+    t[SEMICOLON] = 1;
+    t[EQUALS] = 1;
+    // path allowed: : @
+    t[COLON] = 1;
+    t[AT] = 1;
+    // separators: / ? #
+    t[SLASH] = 1;
+    t[QUESTION] = 1;
+    t[HASH] = 1;
+    // percent-encoding: %
+    t[PERCENT] = 1;
+    return t;
+})();
+export const is_valid_path_char = (char_code) => char_code < 128 && PATH_CHAR_TABLE[char_code] === 1;
 /**
  * Trim trailing punctuation from URL/path per RFC 3986 and GFM rules.
  * - Trims simple trailing: .,;:!?]
  * - Balanced logic for () only (valid in path components)
- * - Invalid chars like [] {} are already stopped by whitelist, but ] trimmed as fallback
+ *
+ * Note on `]`: the mdz parsers (`mdz.ts`, `mdz_stream_parser_url.ts`,
+ * `mdz_lexer.ts`) scan URL/path chars through `is_valid_path_char`, which
+ * already rejects `]` — so it can never reach this function via parser flow.
+ * The `]` branch here is for external callers using this helper directly on
+ * arbitrary URL-ish input (it is part of the published `@fuzdev/fuz_ui`
+ * surface, see `mdz_helpers.test.ts` for direct coverage).
  *
  * Optimized to avoid O(n²) string slicing - tracks end index and slices once at the end.
  */
 export const trim_trailing_punctuation = (url) => {
     let end = url.length;
-    // Trim simple trailing punctuation (] as fallback - whitelist should prevent it)
     while (end > 0) {
         const last_char = url.charCodeAt(end - 1);
         if (last_char === PERIOD ||
@@ -141,25 +197,28 @@ export const trim_trailing_punctuation = (url) => {
         }
     }
     // Handle balanced parentheses ONLY (parens are valid in URI path components)
-    // Count parentheses in the trimmed portion
-    let open_count = 0;
-    let close_count = 0;
-    for (let i = 0; i < end; i++) {
-        const char = url.charCodeAt(i);
-        if (char === LEFT_PAREN)
-            open_count++;
-        if (char === RIGHT_PAREN)
-            close_count++;
-    }
-    // Trim unmatched trailing closing parens
-    while (end > 0 && close_count > open_count) {
-        const last_char = url.charCodeAt(end - 1);
-        if (last_char === RIGHT_PAREN) {
-            end--;
-            close_count--;
+    // Only count parens when the trimmed URL ends with ')' — otherwise the
+    // trailing-paren loop below can't trim anything.
+    if (end > 0 && url.charCodeAt(end - 1) === RIGHT_PAREN) {
+        let open_count = 0;
+        let close_count = 0;
+        for (let i = 0; i < end; i++) {
+            const char = url.charCodeAt(i);
+            if (char === LEFT_PAREN)
+                open_count++;
+            if (char === RIGHT_PAREN)
+                close_count++;
         }
-        else {
-            break;
+        // Trim unmatched trailing closing parens
+        while (end > 0 && close_count > open_count) {
+            const last_char = url.charCodeAt(end - 1);
+            if (last_char === RIGHT_PAREN) {
+                end--;
+                close_count--;
+            }
+            else {
+                break;
+            }
         }
     }
     // Return original string if no trimming, otherwise slice once
@@ -228,13 +287,26 @@ export const mdz_text_content = (nodes) => nodes
  * For case-preserving IDs (e.g. API declarations), see `docs_slugify` in `docs_helpers.svelte.ts`.
  */
 export const mdz_heading_id = (nodes) => slugify(mdz_text_content(nodes), false);
+/**
+ * Generates a lowercase slug id for a heading from plain text content.
+ * Used by the streaming parser which tracks text content directly
+ * rather than building `MdzNode[]` trees.
+ */
+export const mdz_heading_id_from_text = (text) => slugify(text, false);
 /**
  * Check if a string is a URL (`https://` or `http://`).
  * Requires at least one valid character after the protocol.
  * Rejects whitespace and characters that can't start a valid hostname.
  */
-const URL_PATTERN = /^https?:\/\/[^\s)\]}<>.,:/?#!]/;
+const URL_PATTERN = /^https?:\/\/[^\s)\]}<>.,:/?#!]/i;
 export const mdz_is_url = (s) => URL_PATTERN.test(s);
+/**
+ * Check if a link reference is safe to use as an `href` attribute.
+ * References without a colon are always safe (paths, fragments, queries).
+ * References with a colon must use `http(s)://` — rejects `javascript:`, `data:`, etc.
+ */
+const SAFE_PROTOCOL_PATTERN = /^https?:\/\//i;
+export const mdz_is_safe_reference = (reference) => !reference.includes(':') || SAFE_PROTOCOL_PATTERN.test(reference);
 /**
  * Resolves a relative path (`./` or `../`) against a base path.
  * The base is treated as a directory regardless of trailing slash
@@ -269,6 +341,67 @@ export const resolve_relative_path = (reference, base) => {
         segments.push('');
     return segments.join('/');
 };
+/**
+ * Push a node into a children array, coalescing with the previous Text node.
+ * Mutates `prev.content` and `prev.end` when both are Text, avoiding array growth
+ * and an extra allocation. Callers must own `dest` and not retain references to
+ * the prior last element across the call.
+ */
+export const mdz_push_merging_text = (dest, node) => {
+    if (node.type === 'Text') {
+        const last = dest[dest.length - 1];
+        if (last?.type === 'Text') {
+            last.content += node.content;
+            last.end = node.end;
+            return;
+        }
+    }
+    dest.push(node);
+};
+/**
+ * Return a new array with adjacent Text nodes merged into single nodes.
+ * Fast path: returns the original array when no merging is needed.
+ */
+export const mdz_merge_adjacent_text = (nodes) => {
+    if (nodes.length <= 1)
+        return nodes;
+    let needs_merge = false;
+    for (let i = 1; i < nodes.length; i++) {
+        if (nodes[i - 1].type === 'Text' && nodes[i].type === 'Text') {
+            needs_merge = true;
+            break;
+        }
+    }
+    if (!needs_merge)
+        return nodes;
+    const merged = [];
+    let pending = null;
+    for (const node of nodes) {
+        if (node.type === 'Text') {
+            if (pending) {
+                pending = {
+                    type: 'Text',
+                    content: pending.content + node.content,
+                    start: pending.start,
+                    end: node.end,
+                };
+            }
+            else {
+                pending = { ...node };
+            }
+        }
+        else {
+            if (pending) {
+                merged.push(pending);
+                pending = null;
+            }
+            merged.push(node);
+        }
+    }
+    if (pending)
+        merged.push(pending);
+    return merged;
+};
 export const extract_single_tag = (nodes) => {
     let tag = null;
     for (const node of nodes) {

package/dist/mdz_lexer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mdz_lexer.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_lexer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyCH,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,QAAQ,GACjB,YAAY,GACZ,YAAY,GACZ,iBAAiB,GACjB,gBAAgB,GAChB,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,GACnB,yBAAyB,GACzB,0BAA0B,GAC1B,oBAAoB,GACpB,qBAAqB,GACrB,eAAe,GACf,gBAAgB,GAChB,oBAAoB,GACpB,UAAU,GACV,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,sBAAsB,CAAC;AAE1B,MAAM,WAAW,YAAa,SAAQ,YAAY;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAa,SAAQ,YAAY;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACtD,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACtD,IAAI,EAAE,YAAY,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACvD,IAAI,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACxD,IAAI,EAAE,cAAc,CAAC;CACrB;AAED,MAAM,WAAW,yBAA0B,SAAQ,YAAY;IAC9D,IAAI,EAAE,oBAAoB,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC/D,IAAI,EAAE,qBAAqB,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,gBAAgB,CAAC;CACvB;AAED,MAAM,WAAW,qBAAsB,SAAQ,YAAY;IAC1D,IAAI,EAAE,iBAAiB,CAAC;CACxB;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC/C,IAAI,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACvD,IAAI,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,sBAAuB,SAAQ,YAAY;IAC3D,IAAI,EAAE,iBAAiB,CAAC;CACxB;AAMD,qBAAa,QAAQ;;gBAMR,IAAI,EAAE,MAAM;IAIxB,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;CA8zB3B"}
+{"version":3,"file":"mdz_lexer.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_lexer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyCH,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,QAAQ,GACjB,YAAY,GACZ,YAAY,GACZ,iBAAiB,GACjB,gBAAgB,GAChB,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,GACnB,yBAAyB,GACzB,0BAA0B,GAC1B,oBAAoB,GACpB,qBAAqB,GACrB,eAAe,GACf,gBAAgB,GAChB,oBAAoB,GACpB,UAAU,GACV,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,sBAAsB,CAAC;AAE1B,MAAM,WAAW,YAAa,SAAQ,YAAY;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAa,SAAQ,YAAY;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACtD,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACtD,IAAI,EAAE,YAAY,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACvD,IAAI,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACxD,IAAI,EAAE,cAAc,CAAC;CACrB;AAED,MAAM,WAAW,yBAA0B,SAAQ,YAAY;IAC9D,IAAI,EAAE,oBAAoB,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC/D,IAAI,EAAE,qBAAqB,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,gBAAgB,CAAC;CACvB;AAED,MAAM,WAAW,qBAAsB,SAAQ,YAAY;IAC1D,IAAI,EAAE,iBAAiB,CAAC;CACxB;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC/C,IAAI,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACvD,IAAI,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,sBAAuB,SAAQ,YAAY;IAC3D,IAAI,EAAE,iBAAiB,CAAC;CACxB;AAMD,qBAAa,QAAQ;;gBAMR,IAAI,EAAE,MAAM;IAIxB,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;CA4zB3B"}

package/dist/mdz_lexer.js

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import { mdz_is_url, is_letter, is_tag_name_char, is_word_char, is_valid_path_char, trim_trailing_punctuation, BACKTICK, ASTERISK, UNDERSCORE, TILDE, NEWLINE, HYPHEN, HASH, SPACE, TAB, LEFT_ANGLE, RIGHT_ANGLE, SLASH, PERIOD, LEFT_BRACKET, LEFT_PAREN, RIGHT_PAREN, RIGHT_BRACKET, A_UPPER, Z_UPPER, HR_HYPHEN_COUNT, MIN_CODEBLOCK_BACKTICKS, MAX_HEADING_LEVEL, HTTPS_PREFIX_LENGTH, HTTP_PREFIX_LENGTH, is_at_absolute_path, is_at_relative_path, } from './mdz_helpers.js';
+import { mdz_is_url, mdz_is_safe_reference, is_letter, is_tag_name_char, is_word_char, is_valid_path_char, trim_trailing_punctuation, BACKTICK, ASTERISK, UNDERSCORE, TILDE, NEWLINE, HYPHEN, HASH, SPACE, TAB, LEFT_ANGLE, RIGHT_ANGLE, SLASH, PERIOD, LEFT_BRACKET, LEFT_PAREN, RIGHT_PAREN, RIGHT_BRACKET, A_UPPER, Z_UPPER, HR_HYPHEN_COUNT, MIN_CODEBLOCK_BACKTICKS, MAX_HEADING_LEVEL, match_url_prefix_case_insensitive, is_at_absolute_path, is_at_relative_path, } from './mdz_helpers.js';
 //
 // Lexer
 //
@@ -480,6 +480,12 @@ export class MdzLexer {
                 return;
             }
         }
+        // Reject unsafe protocols (javascript:, data:, etc.) — `is_valid_path_char`
+        // permits `:` so we need an explicit filter here.
+        if (!mdz_is_safe_reference(reference)) {
+            this.#revert_tokens_from_link_open(start);
+            return;
+        }
         this.#index = close_paren + 1;
         const link_type = mdz_is_url(reference) ? 'external' : 'internal';
         this.#tokens.push({
@@ -629,7 +635,7 @@ export class MdzLexer {
                 }
             }
             // Check for URL or internal path mid-text (char code guard avoids startsWith on every char)
-            if ((char_code === 104 /* h */ && this.#is_at_url()) ||
+            if (((char_code === 104 /* h */ || char_code === 72) /* H */ && this.#is_at_url()) ||
                 (char_code === SLASH && is_at_absolute_path(this.#text, this.#index)) ||
                 (char_code === PERIOD && is_at_relative_path(this.#text, this.#index))) {
                 break;
@@ -646,13 +652,8 @@ export class MdzLexer {
     // -- Auto-link tokenizers --
     #tokenize_auto_link_url() {
         const start = this.#index;
-        // Consume protocol
-        if (this.#match('https://')) {
-            this.#index += HTTPS_PREFIX_LENGTH;
-        }
-        else if (this.#match('http://')) {
-            this.#index += HTTP_PREFIX_LENGTH;
-        }
+        // Consume protocol (case-insensitive match; original casing preserved in reference)
+        this.#index += match_url_prefix_case_insensitive(this.#text, this.#index);
         // Collect URL characters
         while (this.#index < this.#text.length) {
             const char_code = this.#text.charCodeAt(this.#index);
@@ -706,19 +707,14 @@ export class MdzLexer {
         return false;
     }
     #is_at_url() {
-        if (this.#match('https://')) {
-            if (this.#index + HTTPS_PREFIX_LENGTH >= this.#text.length)
-                return false;
-            const next_char = this.#text.charCodeAt(this.#index + HTTPS_PREFIX_LENGTH);
-            return next_char !== SPACE && next_char !== NEWLINE;
-        }
-        if (this.#match('http://')) {
-            if (this.#index + HTTP_PREFIX_LENGTH >= this.#text.length)
-                return false;
-            const next_char = this.#text.charCodeAt(this.#index + HTTP_PREFIX_LENGTH);
-            return next_char !== SPACE && next_char !== NEWLINE;
-        }
-        return false;
+        // Scheme matching is case-insensitive (RFC 3986).
+        const prefix_len = match_url_prefix_case_insensitive(this.#text, this.#index);
+        if (prefix_len === 0)
+            return false;
+        if (this.#index + prefix_len >= this.#text.length)
+            return false;
+        const next_char = this.#text.charCodeAt(this.#index + prefix_len);
+        return next_char !== SPACE && next_char !== NEWLINE;
     }
     #is_at_word_boundary(index, check_before, check_after) {
         if (check_before && index > 0) {

package/dist/mdz_opcodes.d.ts

@@ -0,0 +1,174 @@
+/**
+ * Opcode types for the mdz streaming parser.
+ *
+ * Opcodes are serializable rendering instructions emitted by `MdzStreamParser`.
+ * They tell a renderer what to do next — open a container, append text, close it,
+ * or revert an optimistic assumption. Target-agnostic: works for HTML, Svelte, PDF, etc.
+ *
+ * The parser makes optimistic assumptions about ambiguous syntax (e.g., `**` is probably bold)
+ * and emits `revert` opcodes to correct when wrong. This enables true streaming rendering
+ * without ever re-parsing.
+ *
+ * @module
+ */
+/**
+ * Unique monotonic identifier for each node created by the parser.
+ * IDs are never reused within a parser instance.
+ */
+export type MdzNodeId = number;
+/** Node types that can be opened as containers. */
+export type MdzContainerNodeType = 'Paragraph' | 'Bold' | 'Italic' | 'Strikethrough' | 'Link' | 'Heading' | 'Element' | 'Component' | 'Codeblock' | 'Code';
+/** Node types for self-contained leaf elements. */
+export type MdzVoidNodeType = 'Hr';
+/** Discriminant for leaf text nodes. */
+export type MdzTextNodeType = 'Text' | 'Code';
+/**
+ * Open a container node. The renderer starts a new element/wrapper.
+ * Children are subsequent opcodes until the matching `close`.
+ */
+export interface MdzOpcodeOpen {
+    type: 'open';
+    id: MdzNodeId;
+    node_type: MdzContainerNodeType;
+    /** Byte offset in the full input where the opening delimiter begins. */
+    start: number;
+    /** Heading level (1-6). Present when `node_type` is `'Heading'`. */
+    level?: 1 | 2 | 3 | 4 | 5 | 6;
+    /** Tag name. Present when `node_type` is `'Element'` or `'Component'`. */
+    name?: string;
+    /** Language hint. Present when `node_type` is `'Codeblock'`. */
+    lang?: string | null;
+}
+/**
+ * Close a previously opened container node.
+ * Carries deferred metadata that wasn't known at open time.
+ */
+export interface MdzOpcodeClose {
+    type: 'close';
+    id: MdzNodeId;
+    /** Byte offset in the full input immediately after the closing delimiter. */
+    end: number;
+    /** Link URL/path, resolved when `](url)` completes. */
+    reference?: string;
+    /** Link type, resolved alongside `reference`. */
+    link_type?: 'external' | 'internal';
+    /** Heading slug, computed from full heading content. */
+    heading_id?: string;
+    /**
+     * If true, consumer drops this node and its descendants from the tree.
+     * Used for whitespace-only paragraphs that match nothing in `mdz_parse`'s
+     * output — the streaming parser emits open/text speculatively, then
+     * retroactively drops the empty wrapper at close.
+     */
+    discard?: boolean;
+}
+/**
+ * Create a leaf text or code node.
+ * The parent is implicit — the innermost open container on the renderer's stack.
+ */
+export interface MdzOpcodeText {
+    type: 'text';
+    id: MdzNodeId;
+    content: string;
+    text_type: MdzTextNodeType;
+    /** Byte offset where this node begins (for Code, the opening backtick). */
+    start: number;
+    /** Byte offset immediately after this node ends (for Code, after the closing backtick). */
+    end: number;
+}
+/**
+ * Append content to an existing text node.
+ * Streaming optimization — avoids creating a new node per chunk
+ * during plain text runs.
+ */
+export interface MdzOpcodeAppendText {
+    type: 'append_text';
+    id: MdzNodeId;
+    content: string;
+}
+/**
+ * Trim `count` characters from the end of an existing text node.
+ * If trimming empties the node, the consumer removes it from its parent.
+ *
+ * Used by paragraph/codeblock close to drop the trailing newline that
+ * separates inline content from the block boundary. Emitted instead of
+ * retroactively mutating the prior `text`/`append_text` opcode, so the
+ * opcode stream is append-only.
+ */
+export interface MdzOpcodeTrimText {
+    type: 'trim_text';
+    id: MdzNodeId;
+    count: number;
+}
+/**
+ * Create a self-contained leaf node (e.g., horizontal rule).
+ * Inserted as a child of the innermost open container, or at root level.
+ */
+export interface MdzOpcodeVoid {
+    type: 'void';
+    id: MdzNodeId;
+    node_type: MdzVoidNodeType;
+    /** Byte offset in the full input where this element begins. */
+    start: number;
+    /** Byte offset immediately after this element ends. */
+    end: number;
+}
+/**
+ * Undo an optimistic open. Removes the container wrapper,
+ * inserts `replacement_text` as literal text at the container's position,
+ * and re-parents the container's children to the grandparent.
+ *
+ * When `wrap_node_type` and `wrap_id` are set, the replacement text and
+ * re-parented children are wrapped in a new container of the given type
+ * instead of being placed directly at the grandparent level. The wrapper
+ * is pushed onto the consumer's stack (open for future content). This is
+ * used for block-level reverts (e.g., codeblock → paragraph) where the
+ * grandparent is root and content needs a container.
+ */
+export interface MdzOpcodeRevert {
+    type: 'revert';
+    id: MdzNodeId;
+    /** The delimiter text to emit as literal content (e.g., `"**"`, `"["`, `"<Tag>"`). */
+    replacement_text: string;
+    /** Byte offset of the original opening delimiter in the full input. */
+    start: number;
+    /** Wrap replacement text and re-parented children in a new container of this type. */
+    wrap_node_type?: MdzContainerNodeType;
+    /** ID for the wrapper node. Required when `wrap_node_type` is set. */
+    wrap_id?: MdzNodeId;
+}
+/**
+ * Retroactively wrap an existing text node in a container.
+ * Used for text-first auto-links: URL/path text streams as plain text,
+ * then gets wrapped in a Link when the URL boundary is found.
+ *
+ * When `trim_end` is set, trailing characters (punctuation) are trimmed
+ * from the target text node and placed in a new sibling Text node after
+ * the Link wrapper, identified by `trim_id`.
+ */
+export interface MdzOpcodeWrap {
+    type: 'wrap';
+    /** ID for the new Link container node. */
+    id: MdzNodeId;
+    /** Container type to wrap in (always `'Link'` for now). */
+    node_type: 'Link';
+    /** ID of the existing text node to wrap. */
+    target_id: MdzNodeId;
+    /** Resolved URL or path reference. */
+    reference: string;
+    /** Whether the link is external (URL) or internal (path). */
+    link_type: 'external' | 'internal';
+    /** Byte offset where the URL/path begins. */
+    start: number;
+    /** Byte offset immediately after the URL/path (before any trimmed punctuation). */
+    end: number;
+    /** Number of trailing chars to trim from target and place after the link. */
+    trim_end?: number;
+    /** ID for the trimmed-text sibling node. Required when `trim_end` > 0. */
+    trim_id?: MdzNodeId;
+}
+/** All node types that can appear in the mdz tree. */
+export type MdzNodeType = MdzContainerNodeType | MdzVoidNodeType | MdzTextNodeType;
+/** Discriminated union of all mdz opcodes. */
+export type MdzOpcode = MdzOpcodeOpen | MdzOpcodeClose | MdzOpcodeText | MdzOpcodeAppendText | MdzOpcodeTrimText | MdzOpcodeVoid | MdzOpcodeRevert | MdzOpcodeWrap;
+//# sourceMappingURL=mdz_opcodes.d.ts.map

package/dist/mdz_opcodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mdz_opcodes.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_opcodes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,mDAAmD;AACnD,MAAM,MAAM,oBAAoB,GAC7B,WAAW,GACX,MAAM,GACN,QAAQ,GACR,eAAe,GACf,MAAM,GACN,SAAS,GACT,SAAS,GACT,WAAW,GACX,WAAW,GACX,MAAM,CAAC;AAEV,mDAAmD;AACnD,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC;AAEnC,wCAAwC;AACxC,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,SAAS,CAAC;IACd,SAAS,EAAE,oBAAoB,CAAC;IAChC,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,SAAS,CAAC;IACd,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACpC,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,eAAe,CAAC;IAC3B,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,aAAa,CAAC;IACpB,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,SAAS,CAAC;IACd,SAAS,EAAE,eAAe,CAAC;IAC3B,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,sFAAsF;IACtF,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,sEAAsE;IACtE,OAAO,CAAC,EAAE,SAAS,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,EAAE,EAAE,SAAS,CAAC;IACd,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,SAAS,EAAE,SAAS,CAAC;IACrB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;IACnC,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,SAAS,CAAC;CACpB;AAED,sDAAsD;AACtD,MAAM,MAAM,WAAW,GAAG,oBAAoB,GAAG,eAAe,GAAG,eAAe,CAAC;AAEnF,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAClB,aAAa,GACb,cAAc,GACd,aAAa,GACb,mBAAmB,GACnB,iBAAiB,GACjB,aAAa,GACb,eAAe,GACf,aAAa,CAAC"}

package/dist/mdz_opcodes.js

@@ -0,0 +1,14 @@
+/**
+ * Opcode types for the mdz streaming parser.
+ *
+ * Opcodes are serializable rendering instructions emitted by `MdzStreamParser`.
+ * They tell a renderer what to do next — open a container, append text, close it,
+ * or revert an optimistic assumption. Target-agnostic: works for HTML, Svelte, PDF, etc.
+ *
+ * The parser makes optimistic assumptions about ambiguous syntax (e.g., `**` is probably bold)
+ * and emits `revert` opcodes to correct when wrong. This enables true streaming rendering
+ * without ever re-parsing.
+ *
+ * @module
+ */
+export {};

package/dist/mdz_opcodes_to_nodes.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Converts a stream of mdz opcodes to the `MdzNode[]` tree representation.
+ *
+ * Stack-based replay: `open` pushes a frame, `close` pops and builds the node,
+ * `text`/`void` create leaf nodes, `append_text` extends the last text node,
+ * `revert` undoes an optimistic open and re-parents children.
+ *
+ * The output is identical to `mdz_parse()` from `mdz.ts`, enabling
+ * validation of the streaming parser against the existing fixture suite.
+ *
+ * @module
+ */
+import type { MdzNode } from './mdz.js';
+import type { MdzOpcode } from './mdz_opcodes.js';
+/**
+ * Convert an array of mdz opcodes to the `MdzNode[]` tree.
+ * Produces output identical to `mdz_parse()`.
+ */
+export declare const mdz_opcodes_to_nodes: (opcodes: Array<MdzOpcode>) => Array<MdzNode>;
+//# sourceMappingURL=mdz_opcodes_to_nodes.d.ts.map

package/dist/mdz_opcodes_to_nodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mdz_opcodes_to_nodes.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_opcodes_to_nodes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAC,OAAO,EAAwD,MAAM,UAAU,CAAC;AAC7F,OAAO,KAAK,EAAC,SAAS,EAAY,MAAM,kBAAkB,CAAC;AAwB3D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,KAAK,CAAC,SAAS,CAAC,KAAG,KAAK,CAAC,OAAO,CAkN7E,CAAC"}