@fuzdev/fuz_ui 0.198.1 → 0.200.0

package/dist/mdz_components.d.ts

@@ -1,22 +1,38 @@
 import type { Component } from 'svelte';
 /**
- * Context for providing custom mdz components.
- * Must be set by the application using mdz.
+ * Component registry for custom Svelte components that can be used in mdz content.
+ *
+ * For example, registering 'Alert' allows using `<Alert>...</Alert>` in mdz content.
+ *
+ * The Map values are the Svelte component constructors.
+ */
+export type MdzComponents = Map<string, Component<any, any>>;
+/**
+ * Element registry for HTML elements that can be used in mdz content.
+ *
+ * For example, registering 'div' allows using `<div>...</div>` in mdz content.
+ *
+ * The Map values are boolean placeholders for future configuration options.
+ */
+export type MdzElements = Map<string, boolean>;
+/**
+ * Context for providing custom mdz components via a getter function.
+ * Set to a getter (e.g., `() => components`) so changes are reflected reactively.
  */
 export declare const mdz_components_context: {
-    get: (error_message?: string) => MdzComponents;
-    get_maybe: () => MdzComponents | undefined;
-    set: (value: MdzComponents) => MdzComponents;
+    get: (error_message?: string) => () => MdzComponents | undefined;
+    get_maybe: () => (() => MdzComponents | undefined) | undefined;
+    set: (value: () => MdzComponents | undefined) => () => MdzComponents | undefined;
 };
 /**
- * Context for providing allowed HTML elements.
- * Must be set by the application using mdz.
+ * Context for providing allowed HTML elements via a getter function.
+ * Set to a getter (e.g., `() => elements`) so changes are reflected reactively.
  * By default, no HTML elements are allowed.
  */
 export declare const mdz_elements_context: {
-    get: (error_message?: string) => MdzElements;
-    get_maybe: () => MdzElements | undefined;
-    set: (value: MdzElements) => MdzElements;
+    get: (error_message?: string) => () => MdzElements | undefined;
+    get_maybe: () => (() => MdzElements | undefined) | undefined;
+    set: (value: () => MdzElements | undefined) => () => MdzElements | undefined;
 };
 /**
  * Context for providing a base path getter for resolving relative links in mdz content.
@@ -30,20 +46,18 @@ export declare const mdz_base_context: {
     get_maybe: () => (() => string | undefined) | undefined;
     set: (value: () => string | undefined) => () => string | undefined;
 };
+interface MdzGetterContext<T> {
+    get_maybe(): (() => T | undefined) | undefined;
+    set(value: () => T | undefined): unknown;
+}
 /**
- * Component registry for custom Svelte components that can be used in mdz content.
- *
- * For example, registering 'Alert' allows using `<Alert>...</Alert>` in mdz content.
- *
- * The Map values are the Svelte component constructors.
- */
-export type MdzComponents = Map<string, Component<any, any>>;
-/**
- * Element registry for HTML elements that can be used in mdz content.
+ * Set an mdz context to a getter that prefers the local `value_fn` and falls
+ * back to the ancestor's value when `value_fn()` returns `undefined`.
  *
- * For example, registering 'div' allows using `<div>...</div>` in mdz content.
- *
- * The Map values are boolean placeholders for future configuration options.
+ * Pass `value_fn` as a getter (not a snapshot) so prop changes remain reactive.
+ * The ancestor lookup happens once at component init — that's intentional, it
+ * captures the surrounding scope's context at mount time.
  */
-export type MdzElements = Map<string, boolean>;
+export declare const set_mdz_context_with_fallback: <T>(context: MdzGetterContext<T>, value_fn: () => T | undefined) => void;
+export {};
 //# sourceMappingURL=mdz_components.d.ts.map

package/dist/mdz_components.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mdz_components.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_components.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,QAAQ,CAAC;AAItC;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;CAAkC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;CAAgC,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;2CAAwB,MAAM,GAAG,SAAS;4BAAlB,MAAM,GAAG,SAAS;uBAAlB,MAAM,GAAG,SAAS,WAAlB,MAAM,GAAG,SAAS;CAAG,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC"}
+{"version":3,"file":"mdz_components.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_components.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,QAAQ,CAAC;AAItC;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,sBAAsB;2CAAwB,aAAa,GAAG,SAAS;4BAAzB,aAAa,GAAG,SAAS;uBAAzB,aAAa,GAAG,SAAS,WAAzB,aAAa,GAAG,SAAS;CAAG,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;2CAAwB,WAAW,GAAG,SAAS;4BAAvB,WAAW,GAAG,SAAS;uBAAvB,WAAW,GAAG,SAAS,WAAvB,WAAW,GAAG,SAAS;CAAG,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;2CAAwB,MAAM,GAAG,SAAS;4BAAlB,MAAM,GAAG,SAAS;uBAAlB,MAAM,GAAG,SAAS,WAAlB,MAAM,GAAG,SAAS;CAAG,CAAC;AAE3E,UAAU,gBAAgB,CAAC,CAAC;IAC3B,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAC/C,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GAAI,CAAC,EAC9C,SAAS,gBAAgB,CAAC,CAAC,CAAC,EAC5B,UAAU,MAAM,CAAC,GAAG,SAAS,KAC3B,IAGF,CAAC"}

package/dist/mdz_components.js

@@ -1,12 +1,12 @@
 import { create_context } from './context_helpers.js';
 /**
- * Context for providing custom mdz components.
- * Must be set by the application using mdz.
+ * Context for providing custom mdz components via a getter function.
+ * Set to a getter (e.g., `() => components`) so changes are reflected reactively.
  */
 export const mdz_components_context = create_context();
 /**
- * Context for providing allowed HTML elements.
- * Must be set by the application using mdz.
+ * Context for providing allowed HTML elements via a getter function.
+ * Set to a getter (e.g., `() => elements`) so changes are reflected reactively.
  * By default, no HTML elements are allowed.
  */
 export const mdz_elements_context = create_context();
@@ -18,3 +18,15 @@ export const mdz_elements_context = create_context();
  * When not set, relative paths use raw hrefs (browser resolves them).
  */
 export const mdz_base_context = create_context();
+/**
+ * Set an mdz context to a getter that prefers the local `value_fn` and falls
+ * back to the ancestor's value when `value_fn()` returns `undefined`.
+ *
+ * Pass `value_fn` as a getter (not a snapshot) so prop changes remain reactive.
+ * The ancestor lookup happens once at component init — that's intentional, it
+ * captures the surrounding scope's context at mount time.
+ */
+export const set_mdz_context_with_fallback = (context, value_fn) => {
+    const ancestor = context.get_maybe();
+    context.set(() => value_fn() ?? ancestor?.());
+};

package/dist/mdz_helpers.d.ts

@@ -47,6 +47,23 @@ export declare const MIN_CODEBLOCK_BACKTICKS = 3;
 export declare const MAX_HEADING_LEVEL = 6;
 export declare const HTTPS_PREFIX_LENGTH = 8;
 export declare const HTTP_PREFIX_LENGTH = 7;
+export declare const H_LOWER = 104;
+export declare const H_UPPER = 72;
+/**
+ * Lowercase an ASCII letter code; passes other chars through.
+ * Mirrors the `[A-Z] → [a-z]` shift without touching non-ASCII.
+ */
+export declare const ascii_to_lower: (char_code: number) => number;
+/**
+ * Case-insensitive URL scheme prefix check. Returns the prefix length
+ * (8 for `https://`, 7 for `http://`) or 0 if neither matches at `pos`.
+ *
+ * URI schemes are case-insensitive per RFC 3986 §3.1, and mobile keyboards
+ * routinely auto-capitalize the first letter of a sentence, producing
+ * `Https://` etc. The original case is preserved in the emitted reference —
+ * browsers normalize schemes themselves.
+ */
+export declare const match_url_prefix_case_insensitive: (s: string, pos: number) => 0 | 7 | 8;
 /**
  * Check if character code is a letter (A-Z, a-z).
  */
@@ -59,30 +76,26 @@ export declare const is_tag_name_char: (char_code: number) => boolean;
  * Check if character is part of a word for word boundary detection.
  * Used to prevent intraword emphasis with `_` and `~` delimiters.
  *
- * Formatting delimiters (`*`, `_`, `~`) are NOT word characters - they're transparent.
- * Only alphanumeric characters (A-Z, a-z, 0-9) are considered word characters.
+ * Only alphanumeric characters (A-Z, a-z, 0-9) are word characters.
+ * Formatting delimiters (`*`, `_`, `~`) fall outside all three ranges,
+ * so they're naturally excluded without explicit checks.
  *
  * This prevents false positives with snake_case identifiers while allowing
  * adjacent formatting like `**bold**_italic_`.
  */
 export declare const is_word_char: (char_code: number) => boolean;
-/**
- * Check if character code is valid in URI path per RFC 3986.
- * Validates against the `pchar` production plus path/query/fragment separators.
- *
- * Valid characters:
- * - unreserved: A-Z a-z 0-9 - . _ ~
- * - sub-delims: ! $ & ' ( ) * + , ; =
- * - path allowed: : @
- * - separators: / ? #
- * - percent-encoding: %
- */
 export declare const is_valid_path_char: (char_code: number) => boolean;
 /**
  * Trim trailing punctuation from URL/path per RFC 3986 and GFM rules.
  * - Trims simple trailing: .,;:!?]
  * - Balanced logic for () only (valid in path components)
- * - Invalid chars like [] {} are already stopped by whitelist, but ] trimmed as fallback
+ *
+ * Note on `]`: the mdz parsers (`mdz.ts`, `mdz_stream_parser_url.ts`,
+ * `mdz_lexer.ts`) scan URL/path chars through `is_valid_path_char`, which
+ * already rejects `]` — so it can never reach this function via parser flow.
+ * The `]` branch here is for external callers using this helper directly on
+ * arbitrary URL-ish input (it is part of the published `@fuzdev/fuz_ui`
+ * surface, see `mdz_helpers.test.ts` for direct coverage).
  *
  * Optimized to avoid O(n²) string slicing - tracks end index and slices once at the end.
  */
@@ -114,7 +127,14 @@ export declare const mdz_text_content: (nodes: Array<MdzNode>) => string;
  * For case-preserving IDs (e.g. API declarations), see `docs_slugify` in `docs_helpers.svelte.ts`.
  */
 export declare const mdz_heading_id: (nodes: Array<MdzNode>) => string;
+/**
+ * Generates a lowercase slug id for a heading from plain text content.
+ * Used by the streaming parser which tracks text content directly
+ * rather than building `MdzNode[]` trees.
+ */
+export declare const mdz_heading_id_from_text: (text: string) => string;
 export declare const mdz_is_url: (s: string) => boolean;
+export declare const mdz_is_safe_reference: (reference: string) => boolean;
 /**
  * Resolves a relative path (`./` or `../`) against a base path.
  * The base is treated as a directory regardless of trailing slash
@@ -128,5 +148,17 @@ export declare const mdz_is_url: (s: string) => boolean;
  * @returns an absolute resolved path (e.g., `'/docs/mdz/grammar'`)
  */
 export declare const resolve_relative_path: (reference: string, base: string) => string;
+/**
+ * Push a node into a children array, coalescing with the previous Text node.
+ * Mutates `prev.content` and `prev.end` when both are Text, avoiding array growth
+ * and an extra allocation. Callers must own `dest` and not retain references to
+ * the prior last element across the call.
+ */
+export declare const mdz_push_merging_text: (dest: Array<MdzNode>, node: MdzNode) => void;
+/**
+ * Return a new array with adjacent Text nodes merged into single nodes.
+ * Fast path: returns the original array when no merging is needed.
+ */
+export declare const mdz_merge_adjacent_text: (nodes: Array<MdzNode>) => Array<MdzNode>;
 export declare const extract_single_tag: (nodes: Array<MdzNode>) => MdzComponentNode | MdzElementNode | null;
 //# sourceMappingURL=mdz_helpers.d.ts.map

package/dist/mdz_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mdz_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAC,MAAM,UAAU,CAAC;AAIxE,eAAO,MAAM,QAAQ,KAAK,CAAC;AAC3B,eAAO,MAAM,QAAQ,KAAK,CAAC;AAC3B,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,KAAK,MAAM,CAAC;AACzB,eAAO,MAAM,OAAO,KAAK,CAAC;AAC1B,eAAO,MAAM,MAAM,KAAK,CAAC;AACzB,eAAO,MAAM,IAAI,KAAK,CAAC;AACvB,eAAO,MAAM,KAAK,KAAK,CAAC;AACxB,eAAO,MAAM,GAAG,IAAI,CAAC;AACrB,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,eAAO,MAAM,KAAK,KAAK,CAAC;AACxB,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,eAAO,MAAM,KAAK,KAAK,CAAC;AACxB,eAAO,MAAM,MAAM,KAAK,CAAC;AACzB,eAAO,MAAM,KAAK,KAAK,CAAC;AACxB,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,eAAO,MAAM,QAAQ,KAAK,CAAC;AAE3B,eAAO,MAAM,MAAM,KAAK,CAAC;AACzB,eAAO,MAAM,OAAO,KAAK,CAAC;AAC1B,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,IAAI,KAAK,CAAC;AACvB,eAAO,MAAM,MAAM,KAAK,CAAC;AACzB,eAAO,MAAM,EAAE,KAAK,CAAC;AAErB,eAAO,MAAM,OAAO,KAAK,CAAC;AAC1B,eAAO,MAAM,OAAO,KAAK,CAAC;AAC1B,eAAO,MAAM,OAAO,KAAK,CAAC;AAC1B,eAAO,MAAM,OAAO,MAAM,CAAC;AAC3B,eAAO,MAAM,IAAI,KAAK,CAAC;AACvB,eAAO,MAAM,IAAI,KAAK,CAAC;AAEvB,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,uBAAuB,IAAI,CAAC;AACzC,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,SAAS,GAAI,WAAW,MAAM,KAAG,OACmD,CAAC;AAElG;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,KAAG,OAI5B,CAAC;AAE1B;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAI,WAAW,MAAM,KAAG,OAOhD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAI,WAAW,MAAM,KAAG,OAwBjC,CAAC;AAEvB;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,GAAI,KAAK,MAAM,KAAG,MA4CvD,CAAC;AAEF;;;;GAIG;AACH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,OASjE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,OAsBjE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAG,MAG9C,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAG,MACf,CAAC;AAQzC,eAAO,MAAM,UAAU,GAAI,GAAG,MAAM,KAAG,OAA8B,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,EAAE,MAAM,MAAM,KAAG,MAgBvE,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,KACnB,gBAAgB,GAAG,cAAc,GAAG,IAiBtC,CAAC"}
+{"version":3,"file":"mdz_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,OAAO,EAAe,gBAAgB,EAAE,cAAc,EAAC,MAAM,UAAU,CAAC;AAIrF,eAAO,MAAM,QAAQ,KAAK,CAAC;AAC3B,eAAO,MAAM,QAAQ,KAAK,CAAC;AAC3B,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,KAAK,MAAM,CAAC;AACzB,eAAO,MAAM,OAAO,KAAK,CAAC;AAC1B,eAAO,MAAM,MAAM,KAAK,CAAC;AACzB,eAAO,MAAM,IAAI,KAAK,CAAC;AACvB,eAAO,MAAM,KAAK,KAAK,CAAC;AACxB,eAAO,MAAM,GAAG,IAAI,CAAC;AACrB,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,eAAO,MAAM,KAAK,KAAK,CAAC;AACxB,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,eAAO,MAAM,KAAK,KAAK,CAAC;AACxB,eAAO,MAAM,MAAM,KAAK,CAAC;AACzB,eAAO,MAAM,KAAK,KAAK,CAAC;AACxB,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,eAAO,MAAM,QAAQ,KAAK,CAAC;AAE3B,eAAO,MAAM,MAAM,KAAK,CAAC;AACzB,eAAO,MAAM,OAAO,KAAK,CAAC;AAC1B,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,IAAI,KAAK,CAAC;AACvB,eAAO,MAAM,MAAM,KAAK,CAAC;AACzB,eAAO,MAAM,EAAE,KAAK,CAAC;AAErB,eAAO,MAAM,OAAO,KAAK,CAAC;AAC1B,eAAO,MAAM,OAAO,KAAK,CAAC;AAC1B,eAAO,MAAM,OAAO,KAAK,CAAC;AAC1B,eAAO,MAAM,OAAO,MAAM,CAAC;AAC3B,eAAO,MAAM,IAAI,KAAK,CAAC;AACvB,eAAO,MAAM,IAAI,KAAK,CAAC;AAEvB,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,uBAAuB,IAAI,CAAC;AACzC,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,OAAO,MAAM,CAAC;AAC3B,eAAO,MAAM,OAAO,KAAK,CAAC;AAE1B;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,WAAW,MAAM,KAAG,MACuB,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,GAAI,GAAG,MAAM,EAAE,KAAK,MAAM,KAAG,CAAC,GAAG,CAAC,GAAG,CA4BlF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,SAAS,GAAI,WAAW,MAAM,KAAG,OACmD,CAAC;AAElG;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,KAAG,OAI5B,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,GAAI,WAAW,MAAM,KAAG,OAGR,CAAC;AA+C1C,eAAO,MAAM,kBAAkB,GAAI,WAAW,MAAM,KAAG,OACH,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,KAAK,MAAM,KAAG,MA8CvD,CAAC;AAEF;;;;GAIG;AACH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,OASjE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,OAsBjE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAG,MAG9C,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAG,MACf,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,MAAM,KAAG,MAA8B,CAAC;AAQvF,eAAO,MAAM,UAAU,GAAI,GAAG,MAAM,KAAG,OAA8B,CAAC;AAQtE,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,KAAG,OACQ,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,EAAE,MAAM,MAAM,KAAG,MAgBvE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,KAAG,IAU3E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,CAuC5E,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,KACnB,gBAAgB,GAAG,cAAc,GAAG,IAiBtC,CAAC"}

package/dist/mdz_helpers.js

@@ -51,6 +51,47 @@ export const MIN_CODEBLOCK_BACKTICKS = 3; // Code blocks require minimum 3 backt
 export const MAX_HEADING_LEVEL = 6; // Headings support levels 1-6
 export const HTTPS_PREFIX_LENGTH = 8; // Length of "https://"
 export const HTTP_PREFIX_LENGTH = 7; // Length of "http://"
+export const H_LOWER = 104; // h
+export const H_UPPER = 72; // H
+/**
+ * Lowercase an ASCII letter code; passes other chars through.
+ * Mirrors the `[A-Z] → [a-z]` shift without touching non-ASCII.
+ */
+export const ascii_to_lower = (char_code) => char_code >= A_UPPER && char_code <= Z_UPPER ? char_code + 32 : char_code;
+/**
+ * Case-insensitive URL scheme prefix check. Returns the prefix length
+ * (8 for `https://`, 7 for `http://`) or 0 if neither matches at `pos`.
+ *
+ * URI schemes are case-insensitive per RFC 3986 §3.1, and mobile keyboards
+ * routinely auto-capitalize the first letter of a sentence, producing
+ * `Https://` etc. The original case is preserved in the emitted reference —
+ * browsers normalize schemes themselves.
+ */
+export const match_url_prefix_case_insensitive = (s, pos) => {
+    if (pos + HTTP_PREFIX_LENGTH > s.length)
+        return 0;
+    // h | H
+    if (ascii_to_lower(s.charCodeAt(pos)) !== H_LOWER)
+        return 0;
+    // 'ttps://' (7 chars) or 'ttp://' (6 chars)
+    if (ascii_to_lower(s.charCodeAt(pos + 1)) === 116 /* t */ &&
+        ascii_to_lower(s.charCodeAt(pos + 2)) === 116 /* t */ &&
+        ascii_to_lower(s.charCodeAt(pos + 3)) === 112 /* p */) {
+        if (pos + HTTPS_PREFIX_LENGTH <= s.length &&
+            ascii_to_lower(s.charCodeAt(pos + 4)) === 115 /* s */ &&
+            s.charCodeAt(pos + 5) === COLON &&
+            s.charCodeAt(pos + 6) === SLASH &&
+            s.charCodeAt(pos + 7) === SLASH) {
+            return HTTPS_PREFIX_LENGTH;
+        }
+        if (s.charCodeAt(pos + 4) === COLON &&
+            s.charCodeAt(pos + 5) === SLASH &&
+            s.charCodeAt(pos + 6) === SLASH) {
+            return HTTP_PREFIX_LENGTH;
+        }
+    }
+    return 0;
+};
 /**
  * Check if character code is a letter (A-Z, a-z).
  */
@@ -66,22 +107,19 @@ export const is_tag_name_char = (char_code) => is_letter(char_code) ||
  * Check if character is part of a word for word boundary detection.
  * Used to prevent intraword emphasis with `_` and `~` delimiters.
  *
- * Formatting delimiters (`*`, `_`, `~`) are NOT word characters - they're transparent.
- * Only alphanumeric characters (A-Z, a-z, 0-9) are considered word characters.
+ * Only alphanumeric characters (A-Z, a-z, 0-9) are word characters.
+ * Formatting delimiters (`*`, `_`, `~`) fall outside all three ranges,
+ * so they're naturally excluded without explicit checks.
  *
  * This prevents false positives with snake_case identifiers while allowing
  * adjacent formatting like `**bold**_italic_`.
  */
-export const is_word_char = (char_code) => {
-    if (char_code === ASTERISK || char_code === UNDERSCORE || char_code === TILDE)
-        return false;
-    return ((char_code >= A_UPPER && char_code <= Z_UPPER) ||
-        (char_code >= A_LOWER && char_code <= Z_LOWER) ||
-        (char_code >= ZERO && char_code <= NINE));
-};
+export const is_word_char = (char_code) => (char_code >= A_UPPER && char_code <= Z_UPPER) ||
+    (char_code >= A_LOWER && char_code <= Z_LOWER) ||
+    (char_code >= ZERO && char_code <= NINE);
 /**
- * Check if character code is valid in URI path per RFC 3986.
- * Validates against the `pchar` production plus path/query/fragment separators.
+ * Lookup table for valid URI path characters per RFC 3986.
+ * Replaces a 16-comparison chain with a single array access.
  *
  * Valid characters:
  * - unreserved: A-Z a-z 0-9 - . _ ~
@@ -90,41 +128,59 @@ export const is_word_char = (char_code) => {
  * - separators: / ? #
  * - percent-encoding: %
  */
-export const is_valid_path_char = (char_code) => (char_code >= A_UPPER && char_code <= Z_UPPER) ||
-    (char_code >= A_LOWER && char_code <= Z_LOWER) ||
-    (char_code >= ZERO && char_code <= NINE) ||
-    char_code === HYPHEN ||
-    char_code === PERIOD ||
-    char_code === UNDERSCORE ||
-    char_code === TILDE ||
-    char_code === EXCLAMATION ||
-    char_code === DOLLAR ||
-    char_code === AMPERSAND ||
-    char_code === APOSTROPHE ||
-    char_code === LEFT_PAREN ||
-    char_code === RIGHT_PAREN ||
-    char_code === ASTERISK ||
-    char_code === PLUS ||
-    char_code === COMMA ||
-    char_code === SEMICOLON ||
-    char_code === EQUALS ||
-    char_code === COLON ||
-    char_code === AT ||
-    char_code === SLASH ||
-    char_code === QUESTION ||
-    char_code === HASH ||
-    char_code === PERCENT;
+const PATH_CHAR_TABLE = (() => {
+    const t = new Uint8Array(128);
+    for (let i = A_UPPER; i <= Z_UPPER; i++)
+        t[i] = 1;
+    for (let i = A_LOWER; i <= Z_LOWER; i++)
+        t[i] = 1;
+    for (let i = ZERO; i <= NINE; i++)
+        t[i] = 1;
+    // unreserved: - . _ ~
+    t[HYPHEN] = 1;
+    t[PERIOD] = 1;
+    t[UNDERSCORE] = 1;
+    t[TILDE] = 1;
+    // sub-delims: ! $ & ' ( ) * + , ; =
+    t[EXCLAMATION] = 1;
+    t[DOLLAR] = 1;
+    t[AMPERSAND] = 1;
+    t[APOSTROPHE] = 1;
+    t[LEFT_PAREN] = 1;
+    t[RIGHT_PAREN] = 1;
+    t[ASTERISK] = 1;
+    t[PLUS] = 1;
+    t[COMMA] = 1;
+    t[SEMICOLON] = 1;
+    t[EQUALS] = 1;
+    // path allowed: : @
+    t[COLON] = 1;
+    t[AT] = 1;
+    // separators: / ? #
+    t[SLASH] = 1;
+    t[QUESTION] = 1;
+    t[HASH] = 1;
+    // percent-encoding: %
+    t[PERCENT] = 1;
+    return t;
+})();
+export const is_valid_path_char = (char_code) => char_code < 128 && PATH_CHAR_TABLE[char_code] === 1;
 /**
  * Trim trailing punctuation from URL/path per RFC 3986 and GFM rules.
  * - Trims simple trailing: .,;:!?]
  * - Balanced logic for () only (valid in path components)
- * - Invalid chars like [] {} are already stopped by whitelist, but ] trimmed as fallback
+ *
+ * Note on `]`: the mdz parsers (`mdz.ts`, `mdz_stream_parser_url.ts`,
+ * `mdz_lexer.ts`) scan URL/path chars through `is_valid_path_char`, which
+ * already rejects `]` — so it can never reach this function via parser flow.
+ * The `]` branch here is for external callers using this helper directly on
+ * arbitrary URL-ish input (it is part of the published `@fuzdev/fuz_ui`
+ * surface, see `mdz_helpers.test.ts` for direct coverage).
  *
  * Optimized to avoid O(n²) string slicing - tracks end index and slices once at the end.
  */
 export const trim_trailing_punctuation = (url) => {
     let end = url.length;
-    // Trim simple trailing punctuation (] as fallback - whitelist should prevent it)
     while (end > 0) {
         const last_char = url.charCodeAt(end - 1);
         if (last_char === PERIOD ||
@@ -141,25 +197,28 @@ export const trim_trailing_punctuation = (url) => {
         }
     }
     // Handle balanced parentheses ONLY (parens are valid in URI path components)
-    // Count parentheses in the trimmed portion
-    let open_count = 0;
-    let close_count = 0;
-    for (let i = 0; i < end; i++) {
-        const char = url.charCodeAt(i);
-        if (char === LEFT_PAREN)
-            open_count++;
-        if (char === RIGHT_PAREN)
-            close_count++;
-    }
-    // Trim unmatched trailing closing parens
-    while (end > 0 && close_count > open_count) {
-        const last_char = url.charCodeAt(end - 1);
-        if (last_char === RIGHT_PAREN) {
-            end--;
-            close_count--;
+    // Only count parens when the trimmed URL ends with ')' — otherwise the
+    // trailing-paren loop below can't trim anything.
+    if (end > 0 && url.charCodeAt(end - 1) === RIGHT_PAREN) {
+        let open_count = 0;
+        let close_count = 0;
+        for (let i = 0; i < end; i++) {
+            const char = url.charCodeAt(i);
+            if (char === LEFT_PAREN)
+                open_count++;
+            if (char === RIGHT_PAREN)
+                close_count++;
         }
-        else {
-            break;
+        // Trim unmatched trailing closing parens
+        while (end > 0 && close_count > open_count) {
+            const last_char = url.charCodeAt(end - 1);
+            if (last_char === RIGHT_PAREN) {
+                end--;
+                close_count--;
+            }
+            else {
+                break;
+            }
         }
     }
     // Return original string if no trimming, otherwise slice once
@@ -228,13 +287,26 @@ export const mdz_text_content = (nodes) => nodes
  * For case-preserving IDs (e.g. API declarations), see `docs_slugify` in `docs_helpers.svelte.ts`.
  */
 export const mdz_heading_id = (nodes) => slugify(mdz_text_content(nodes), false);
+/**
+ * Generates a lowercase slug id for a heading from plain text content.
+ * Used by the streaming parser which tracks text content directly
+ * rather than building `MdzNode[]` trees.
+ */
+export const mdz_heading_id_from_text = (text) => slugify(text, false);
 /**
  * Check if a string is a URL (`https://` or `http://`).
  * Requires at least one valid character after the protocol.
  * Rejects whitespace and characters that can't start a valid hostname.
  */
-const URL_PATTERN = /^https?:\/\/[^\s)\]}<>.,:/?#!]/;
+const URL_PATTERN = /^https?:\/\/[^\s)\]}<>.,:/?#!]/i;
 export const mdz_is_url = (s) => URL_PATTERN.test(s);
+/**
+ * Check if a link reference is safe to use as an `href` attribute.
+ * References without a colon are always safe (paths, fragments, queries).
+ * References with a colon must use `http(s)://` — rejects `javascript:`, `data:`, etc.
+ */
+const SAFE_PROTOCOL_PATTERN = /^https?:\/\//i;
+export const mdz_is_safe_reference = (reference) => !reference.includes(':') || SAFE_PROTOCOL_PATTERN.test(reference);
 /**
  * Resolves a relative path (`./` or `../`) against a base path.
  * The base is treated as a directory regardless of trailing slash
@@ -269,6 +341,67 @@ export const resolve_relative_path = (reference, base) => {
         segments.push('');
     return segments.join('/');
 };
+/**
+ * Push a node into a children array, coalescing with the previous Text node.
+ * Mutates `prev.content` and `prev.end` when both are Text, avoiding array growth
+ * and an extra allocation. Callers must own `dest` and not retain references to
+ * the prior last element across the call.
+ */
+export const mdz_push_merging_text = (dest, node) => {
+    if (node.type === 'Text') {
+        const last = dest[dest.length - 1];
+        if (last?.type === 'Text') {
+            last.content += node.content;
+            last.end = node.end;
+            return;
+        }
+    }
+    dest.push(node);
+};
+/**
+ * Return a new array with adjacent Text nodes merged into single nodes.
+ * Fast path: returns the original array when no merging is needed.
+ */
+export const mdz_merge_adjacent_text = (nodes) => {
+    if (nodes.length <= 1)
+        return nodes;
+    let needs_merge = false;
+    for (let i = 1; i < nodes.length; i++) {
+        if (nodes[i - 1].type === 'Text' && nodes[i].type === 'Text') {
+            needs_merge = true;
+            break;
+        }
+    }
+    if (!needs_merge)
+        return nodes;
+    const merged = [];
+    let pending = null;
+    for (const node of nodes) {
+        if (node.type === 'Text') {
+            if (pending) {
+                pending = {
+                    type: 'Text',
+                    content: pending.content + node.content,
+                    start: pending.start,
+                    end: node.end,
+                };
+            }
+            else {
+                pending = { ...node };
+            }
+        }
+        else {
+            if (pending) {
+                merged.push(pending);
+                pending = null;
+            }
+            merged.push(node);
+        }
+    }
+    if (pending)
+        merged.push(pending);
+    return merged;
+};
 export const extract_single_tag = (nodes) => {
     let tag = null;
     for (const node of nodes) {

package/dist/mdz_lexer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mdz_lexer.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_lexer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyCH,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,QAAQ,GACjB,YAAY,GACZ,YAAY,GACZ,iBAAiB,GACjB,gBAAgB,GAChB,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,GACnB,yBAAyB,GACzB,0BAA0B,GAC1B,oBAAoB,GACpB,qBAAqB,GACrB,eAAe,GACf,gBAAgB,GAChB,oBAAoB,GACpB,UAAU,GACV,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,sBAAsB,CAAC;AAE1B,MAAM,WAAW,YAAa,SAAQ,YAAY;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAa,SAAQ,YAAY;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACtD,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACtD,IAAI,EAAE,YAAY,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACvD,IAAI,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACxD,IAAI,EAAE,cAAc,CAAC;CACrB;AAED,MAAM,WAAW,yBAA0B,SAAQ,YAAY;IAC9D,IAAI,EAAE,oBAAoB,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC/D,IAAI,EAAE,qBAAqB,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,gBAAgB,CAAC;CACvB;AAED,MAAM,WAAW,qBAAsB,SAAQ,YAAY;IAC1D,IAAI,EAAE,iBAAiB,CAAC;CACxB;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC/C,IAAI,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACvD,IAAI,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,sBAAuB,SAAQ,YAAY;IAC3D,IAAI,EAAE,iBAAiB,CAAC;CACxB;AAMD,qBAAa,QAAQ;;gBAMR,IAAI,EAAE,MAAM;IAIxB,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;CA8zB3B"}
+{"version":3,"file":"mdz_lexer.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_lexer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAyCH,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,QAAQ,GACjB,YAAY,GACZ,YAAY,GACZ,iBAAiB,GACjB,gBAAgB,GAChB,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,GACnB,yBAAyB,GACzB,0BAA0B,GAC1B,oBAAoB,GACpB,qBAAqB,GACrB,eAAe,GACf,gBAAgB,GAChB,oBAAoB,GACpB,UAAU,GACV,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,sBAAsB,CAAC;AAE1B,MAAM,WAAW,YAAa,SAAQ,YAAY;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAa,SAAQ,YAAY;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACtD,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACtD,IAAI,EAAE,YAAY,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACvD,IAAI,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACxD,IAAI,EAAE,cAAc,CAAC;CACrB;AAED,MAAM,WAAW,yBAA0B,SAAQ,YAAY;IAC9D,IAAI,EAAE,oBAAoB,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC/D,IAAI,EAAE,qBAAqB,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,gBAAgB,CAAC;CACvB;AAED,MAAM,WAAW,qBAAsB,SAAQ,YAAY;IAC1D,IAAI,EAAE,iBAAiB,CAAC;CACxB;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;CACnC;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC/C,IAAI,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACzD,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACvD,IAAI,EAAE,aAAa,CAAC;CACpB;AAED,MAAM,WAAW,sBAAuB,SAAQ,YAAY;IAC3D,IAAI,EAAE,iBAAiB,CAAC;CACxB;AAMD,qBAAa,QAAQ;;gBAMR,IAAI,EAAE,MAAM;IAIxB,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;CA4zB3B"}

package/dist/mdz_lexer.js

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import { mdz_is_url, is_letter, is_tag_name_char, is_word_char, is_valid_path_char, trim_trailing_punctuation, BACKTICK, ASTERISK, UNDERSCORE, TILDE, NEWLINE, HYPHEN, HASH, SPACE, TAB, LEFT_ANGLE, RIGHT_ANGLE, SLASH, PERIOD, LEFT_BRACKET, LEFT_PAREN, RIGHT_PAREN, RIGHT_BRACKET, A_UPPER, Z_UPPER, HR_HYPHEN_COUNT, MIN_CODEBLOCK_BACKTICKS, MAX_HEADING_LEVEL, HTTPS_PREFIX_LENGTH, HTTP_PREFIX_LENGTH, is_at_absolute_path, is_at_relative_path, } from './mdz_helpers.js';
+import { mdz_is_url, mdz_is_safe_reference, is_letter, is_tag_name_char, is_word_char, is_valid_path_char, trim_trailing_punctuation, BACKTICK, ASTERISK, UNDERSCORE, TILDE, NEWLINE, HYPHEN, HASH, SPACE, TAB, LEFT_ANGLE, RIGHT_ANGLE, SLASH, PERIOD, LEFT_BRACKET, LEFT_PAREN, RIGHT_PAREN, RIGHT_BRACKET, A_UPPER, Z_UPPER, HR_HYPHEN_COUNT, MIN_CODEBLOCK_BACKTICKS, MAX_HEADING_LEVEL, match_url_prefix_case_insensitive, is_at_absolute_path, is_at_relative_path, } from './mdz_helpers.js';
 //
 // Lexer
 //
@@ -480,6 +480,12 @@ export class MdzLexer {
                 return;
             }
         }
+        // Reject unsafe protocols (javascript:, data:, etc.) — `is_valid_path_char`
+        // permits `:` so we need an explicit filter here.
+        if (!mdz_is_safe_reference(reference)) {
+            this.#revert_tokens_from_link_open(start);
+            return;
+        }
         this.#index = close_paren + 1;
         const link_type = mdz_is_url(reference) ? 'external' : 'internal';
         this.#tokens.push({
@@ -629,7 +635,7 @@ export class MdzLexer {
                 }
             }
             // Check for URL or internal path mid-text (char code guard avoids startsWith on every char)
-            if ((char_code === 104 /* h */ && this.#is_at_url()) ||
+            if (((char_code === 104 /* h */ || char_code === 72) /* H */ && this.#is_at_url()) ||
                 (char_code === SLASH && is_at_absolute_path(this.#text, this.#index)) ||
                 (char_code === PERIOD && is_at_relative_path(this.#text, this.#index))) {
                 break;
@@ -646,13 +652,8 @@ export class MdzLexer {
     // -- Auto-link tokenizers --
     #tokenize_auto_link_url() {
         const start = this.#index;
-        // Consume protocol
-        if (this.#match('https://')) {
-            this.#index += HTTPS_PREFIX_LENGTH;
-        }
-        else if (this.#match('http://')) {
-            this.#index += HTTP_PREFIX_LENGTH;
-        }
+        // Consume protocol (case-insensitive match; original casing preserved in reference)
+        this.#index += match_url_prefix_case_insensitive(this.#text, this.#index);
         // Collect URL characters
         while (this.#index < this.#text.length) {
             const char_code = this.#text.charCodeAt(this.#index);
@@ -706,19 +707,14 @@ export class MdzLexer {
         return false;
     }
     #is_at_url() {
-        if (this.#match('https://')) {
-            if (this.#index + HTTPS_PREFIX_LENGTH >= this.#text.length)
-                return false;
-            const next_char = this.#text.charCodeAt(this.#index + HTTPS_PREFIX_LENGTH);
-            return next_char !== SPACE && next_char !== NEWLINE;
-        }
-        if (this.#match('http://')) {
-            if (this.#index + HTTP_PREFIX_LENGTH >= this.#text.length)
-                return false;
-            const next_char = this.#text.charCodeAt(this.#index + HTTP_PREFIX_LENGTH);
-            return next_char !== SPACE && next_char !== NEWLINE;
-        }
-        return false;
+        // Scheme matching is case-insensitive (RFC 3986).
+        const prefix_len = match_url_prefix_case_insensitive(this.#text, this.#index);
+        if (prefix_len === 0)
+            return false;
+        if (this.#index + prefix_len >= this.#text.length)
+            return false;
+        const next_char = this.#text.charCodeAt(this.#index + prefix_len);
+        return next_char !== SPACE && next_char !== NEWLINE;
     }
     #is_at_word_boundary(index, check_before, check_after) {
         if (check_before && index > 0) {