@fuzdev/mdz 0.2.0 → 0.3.0

package/src/lib/mdz.ts

@@ -89,6 +89,15 @@ export class MdzTableCellParser {
 		this.#lexer = new MdzLexer(text);
 	}
 
+	/**
+	 * Rebind to a new buffer so one instance serves a whole table — the
+	 * streaming path rebinds per row (the buffer string changes across feeds;
+	 * the lexer's search memo survives when it doesn't).
+	 */
+	rebind(text: string): void {
+		this.#lexer.rebind(text);
+	}
+
 	parse(cell_start: number, cell_end: number): Array<MdzNode> {
 		this.#parser.reset(this.#lexer.lex_table_cell(cell_start, cell_end));
 		return this.#parser.parse_inline_run();

package/src/lib/mdz_debug_work.ts

@@ -0,0 +1,38 @@
+/**
+ * Deterministic scan-work counter for the complexity-ratio guards
+ * (`mdz_scaling_ratio.test.ts`). Off by default; when `enabled`, the parser hot
+ * paths accumulate the number of characters scanned (and tag-stack frames
+ * walked) into `total`. Unlike wall-clock timing this is a pure function of
+ * input + algorithm — invariant across machines, runs, and thermal state — so a
+ * super-linear regression shows up as a work ratio > ~linear regardless of the
+ * ~2× machine variance that makes absolute timing unusable here. Its sole
+ * consumer is `mdz_scaling_ratio.test.ts`.
+ *
+ * Coverage is the dominant re-scan choke points — `#index_of` + `#tokenize_text`
+ * (sync) and the streaming memo scans, `consume_text_run`, and `try_close_tag`'s
+ * stack walk — not every scan. A super-linear regression isolated to an
+ * *uncounted* probe (e.g. `#has_paragraph_break_between`, the tag-name collection
+ * loop, the URL/path probes) wouldn't move the ratio; extend the instrumentation
+ * if hot cost ever migrates there.
+ *
+ * Zero store when disabled: each instrumented site guards on `enabled` (a single
+ * branch-predicted property load, the same category as the shipped `DEV`
+ * checks). It is deliberately NOT the `esm-env` `DEV` flag — `DEV` is true under
+ * every `gro test`/`gro dev` run, which would leave the counter live in ordinary
+ * development; this flag is flipped true only by the ratio test.
+ *
+ * @nodocs
+ */
+export const mdz_debug_work: {enabled: boolean; total: number} = {enabled: false, total: 0};
+
+/**
+ * Reset the counter and set whether the hot paths accumulate into it. Tests call
+ * `mdz_debug_work_reset()` immediately before a parse and read
+ * `mdz_debug_work.total` immediately after; pass `false` to disable and zero it.
+ *
+ * @nodocs
+ */
+export const mdz_debug_work_reset = (enabled = true): void => {
+	mdz_debug_work.enabled = enabled;
+	mdz_debug_work.total = 0;
+};

package/src/lib/mdz_helpers.ts

@@ -99,6 +99,23 @@ export const MIN_CODEBLOCK_BACKTICKS = 3; // Code blocks require minimum 3 backt
 export const MAX_LIST_NUMBER_DIGITS = 9; // Ordered list markers cap at 9 digits (CommonMark's cap)
 /** @nodocs */
 export const MAX_HEADING_LEVEL = 6; // Headings support levels 1-6
+/**
+ * Cap on inline link/tag nesting depth. Reached at this many open
+ * `Link`/`Element`/`Component` containers, a further `[` or `<tag>` opener
+ * renders as literal text in both parsers rather than opening — a strict
+ * untrusted-content dialect's bound on pathological nesting (CommonMark
+ * permits such a limit). It bounds both the sync lexer's recursion depth (no
+ * stack overflow) and, with the failure memo, its revert re-scan work (linear
+ * instead of quadratic) on adversarial nested `[`/`<`. Deliberately far above
+ * any real content (inline nesting rarely exceeds a handful); only pathological
+ * input reaches it. Mirrored in the streaming parser so the two agree on where
+ * the cap bites. Delimiters (`**`/`_`/`~~`/`` ` ``) are uncounted: first-closer-wins
+ * keeps them from nesting deeply on their own, and mixed delimiter/link chains
+ * only deep-nest through the links, which this bounds.
+ *
+ * @nodocs
+ */
+export const MAX_INLINE_NESTING_DEPTH = 100;
 /** @nodocs */
 export const HTTPS_PREFIX_LENGTH = 8; // Length of "https://"
 /** @nodocs */
@@ -547,6 +564,40 @@ const PATH_CHAR_TABLE: Uint8Array = (() => {
 export const is_valid_path_char = (char_code: number): boolean =>
 	char_code < 128 && PATH_CHAR_TABLE[char_code] === 1;
 
+// Character classes for the plain-text run scanners (the hottest loops in
+// both parsers) — one table load per character instead of a comparison chain.
+// A zero class is the common case: the char can't end or interrupt a text run.
+
+/** Always ends a text run: `` ` `` `*` `_` `~` `[` `]` `<`. @nodocs */
+export const TEXT_CLASS_STOP = 1;
+/** `\n` — run handling is context-dependent (soft break, paragraph break, block lookahead). @nodocs */
+export const TEXT_CLASS_NEWLINE = 2;
+/** `h`/`H` — potential URL scheme start, needs the prefix probe. @nodocs */
+export const TEXT_CLASS_URL = 4;
+/** `/` and `.` — potential path start, needs the boundary probe. @nodocs */
+export const TEXT_CLASS_PATH = 8;
+/** `\` — a literal-pipe escape candidate inside table cells only. @nodocs */
+export const TEXT_CLASS_BACKSLASH = 16;
+
+/** @nodocs */
+export const TEXT_SCAN_CLASS: Uint8Array = (() => {
+	const t = new Uint8Array(128);
+	t[BACKTICK] = TEXT_CLASS_STOP;
+	t[ASTERISK] = TEXT_CLASS_STOP;
+	t[UNDERSCORE] = TEXT_CLASS_STOP;
+	t[TILDE] = TEXT_CLASS_STOP;
+	t[LEFT_BRACKET] = TEXT_CLASS_STOP;
+	t[RIGHT_BRACKET] = TEXT_CLASS_STOP;
+	t[LEFT_ANGLE] = TEXT_CLASS_STOP;
+	t[NEWLINE] = TEXT_CLASS_NEWLINE;
+	t[H_LOWER] = TEXT_CLASS_URL;
+	t[H_UPPER] = TEXT_CLASS_URL;
+	t[SLASH] = TEXT_CLASS_PATH;
+	t[PERIOD] = TEXT_CLASS_PATH;
+	t[BACKSLASH] = TEXT_CLASS_BACKSLASH;
+	return t;
+})();
+
 /**
  * Trim trailing punctuation from URL/path per RFC 3986 and GFM rules.
  * - Trims simple trailing: .,;:!?]
@@ -760,6 +811,52 @@ export const mdz_resolve_relative_path = (reference: string, base: string): stri
 	return segments.join('/');
 };
 
+/**
+ * How a `Link` node's `reference` should render, shared by all three renderers
+ * (`MdzNodeView`, `MdzStreamNodeView`, `mdz_to_svelte`) so the safety gate and
+ * the resolve-vs-raw classification can't drift between them.
+ * @nodocs
+ */
+export type MdzLinkRender =
+	/** Unsafe protocol — render children only, no `<a>`. */
+	| {kind: 'unsafe'}
+	/** Route/relative path — wrap in `resolve()` (needs `$app/paths`). */
+	| {kind: 'resolve'; href: string}
+	/** Internal fragment/query/relative/bare ref — raw `href`, no `resolve()`. */
+	| {kind: 'internal'; href: string}
+	/** External link — raw `href` plus `target="_blank" rel="noopener"`. */
+	| {kind: 'external'; href: string};
+
+/**
+ * Classify a `Link` reference into how it should render. Pure — no rendering,
+ * no context; `base` is the resolved base path (or `undefined`).
+ * @nodocs
+ */
+export const mdz_classify_link = (
+	reference: string,
+	link_type: 'internal' | 'external' | undefined,
+	base: string | undefined,
+): MdzLinkRender => {
+	if (!mdz_is_safe_reference(reference)) return {kind: 'unsafe'};
+	if (link_type === 'internal') {
+		if (reference.startsWith('.') && base) {
+			return {kind: 'resolve', href: mdz_resolve_relative_path(reference, base)};
+		}
+		// fragment/query/relative/bare — `resolve()` only accepts absolute paths or
+		// route ids and throws on anything else
+		if (
+			reference.startsWith('#') ||
+			reference.startsWith('?') ||
+			reference.startsWith('.') ||
+			!reference.startsWith('/')
+		) {
+			return {kind: 'internal', href: reference};
+		}
+		return {kind: 'resolve', href: reference};
+	}
+	return {kind: 'external', href: reference};
+};
+
 /**
  * Push a node into a children array, coalescing with the previous Text node.
  * Mutates `prev.content` and `prev.end` when both are Text, avoiding array growth

package/src/lib/mdz_lexer.ts

@@ -38,6 +38,7 @@ import {
 	HR_HYPHEN_COUNT,
 	MIN_CODEBLOCK_BACKTICKS,
 	MAX_HEADING_LEVEL,
+	MAX_INLINE_NESTING_DEPTH,
 	MAX_LIST_NUMBER_DIGITS,
 	match_url_prefix_case_insensitive,
 	is_at_absolute_path,
@@ -50,10 +51,15 @@ import {
 	mdz_split_table_row,
 	mdz_parse_table_delimiter,
 	PIPE,
-	BACKSLASH,
+	TEXT_CLASS_BACKSLASH,
+	TEXT_CLASS_NEWLINE,
+	TEXT_CLASS_STOP,
+	TEXT_CLASS_URL,
+	TEXT_SCAN_CLASS,
 } from './mdz_helpers.ts';
 
 import type {MdzTableAlign} from './mdz.ts';
+import {mdz_debug_work} from './mdz_debug_work.ts';
 
 //
 // Token types
@@ -304,11 +310,69 @@ export class MdzLexer {
 	 * and `\|` unescapes to a literal pipe.
 	 */
 	#in_table_cell: boolean = false;
+	/**
+	 * Start offsets of markdown-link opens (`[`) that definitively failed — so
+	 * a re-lex from before the `[` short-circuits to literal text instead of
+	 * re-attempting (and re-descending into) the same failing link. Without it,
+	 * the revert-and-re-tokenize failure path is exponential on nested `[`
+	 * (a ~30-byte `[`×n input hangs). A link's outcome (does a valid `](ref)`
+	 * follow?) is independent of `#max_search_index`, so `start` alone keys it.
+	 * The outcome is a pure function of the immutable text, so the memo is valid
+	 * for the whole lex and across table-cell ranges; cleared on `rebind`.
+	 */
+	#failed_link_starts: Set<number> = new Set();
+	/**
+	 * The tag analogue of `#failed_link_starts`, keyed `${start}:${bound}`. A
+	 * tag's closer search respects `#max_search_index`, so the same `start` can
+	 * fail under a narrow bound yet succeed under the wider one a re-lex uses —
+	 * the bound is part of the key.
+	 */
+	#failed_tag: Set<string> = new Set();
+	/**
+	 * Current link/tag nesting depth — the number of open
+	 * `link_text_open`/`tag_open` containers being recursed into. Bumped around
+	 * `#tokenize_markdown_link`/`#tokenize_tag`'s children loops (not by
+	 * delimiters, which can't nest deeply — see `MAX_INLINE_NESTING_DEPTH`). At
+	 * the cap a further `[`/`<` renders literal instead of opening, bounding
+	 * recursion depth (no stack overflow) and, with the failure memos, the
+	 * revert re-scan (linear, not quadratic) on adversarial nesting.
+	 */
+	#inline_depth: number = 0;
+	/**
+	 * Start offsets of `[`/`<` openers suppressed by the nesting-depth cap
+	 * (`#inline_depth >= MAX_INLINE_NESTING_DEPTH`) — position-keyed like
+	 * `#failed_link_starts` so a re-lex from a shallower depth short-circuits to
+	 * literal text rather than re-opening the construct (which would reintroduce
+	 * the quadratic the cap removes). A suppression is bound-independent, so
+	 * `start` alone keys it; cleared on `rebind`.
+	 */
+	#depth_capped: Set<number> = new Set();
 
 	constructor(text: string) {
 		this.#text = text;
 	}
 
+	/**
+	 * Rebind to a new text, so one lexer instance can be reused across inputs —
+	 * the streaming table path reuses one across a table's rows via
+	 * `MdzTableCellParser` instead of allocating a lexer (and its memo `Map`)
+	 * per row. The search memos survive when the text is identical (they're
+	 * valid over the immutable text — the common case for rows parsed from one
+	 * buffered chunk) and clear otherwise. Per-parse cursor state is reset by
+	 * `lex_table_cell` itself.
+	 *
+	 * @nodocs
+	 */
+	rebind(text: string): void {
+		if (this.#text === text) return;
+		this.#text = text;
+		this.#search_memo.clear();
+		this.#break_memo = null;
+		this.#failed_link_starts.clear();
+		this.#failed_tag.clear();
+		this.#depth_capped.clear();
+	}
+
 	/**
 	 * Memoized `String#indexOf` over the immutable text.
 	 *
@@ -325,6 +389,10 @@ export class MdzLexer {
 			return memo.result;
 		}
 		const result = this.#text.indexOf(needle, from);
+		if (mdz_debug_work.enabled) {
+			// scan span: `indexOf` examined [from, result] (found) or [from, EOF)
+			mdz_debug_work.total += (result === -1 ? this.#text.length : result) - from;
+		}
 		if (memo === undefined) {
 			this.#search_memo.set(needle, {from, result});
 		} else {
@@ -376,6 +444,9 @@ export class MdzLexer {
 	 */
 	lex_table_cell(cell_start: number, cell_end: number): Array<MdzToken> {
 		this.#tokens = [];
+		// depth is balanced back to 0 per cell, but pin it so a future early-return
+		// between an `#inline_depth++` and its decrement can't leak into the next cell
+		this.#inline_depth = 0;
 		this.#tokenize_cell_inline(cell_start, cell_end);
 		return this.#tokens;
 	}
@@ -1541,6 +1612,23 @@ export class MdzLexer {
 
 	#tokenize_markdown_link(): void {
 		const start = this.#index;
+		// a link open at this offset already failed, or was suppressed by the
+		// nesting cap — emit `[` as text instead of re-descending into the same
+		// failing children (exponential on nested `[`); the short-circuit
+		// reproduces the revert's exact net effect (`[` text, cursor at start + 1)
+		if (this.#failed_link_starts.has(start) || this.#depth_capped.has(start)) {
+			this.#index = start + 1;
+			this.#emit_text('[', start);
+			return;
+		}
+		// nesting-depth cap: too deep to open — render literal and record the
+		// suppression so a shallower re-lex short-circuits here too
+		if (this.#inline_depth >= MAX_INLINE_NESTING_DEPTH) {
+			this.#depth_capped.add(start);
+			this.#index = start + 1;
+			this.#emit_text('[', start);
+			return;
+		}
 		this.#index++; // consume [ (dispatch guarantees it)
 
 		// Emit link_text_open
@@ -1549,11 +1637,13 @@ export class MdzLexer {
 		// Tokenize children until ] — only `]` delimits link text; a bare `)`
 		// is ordinary content (matching the streaming parser, which has no `)`
 		// dispatch case — the reference scan finds its own `)` after `](`)
+		this.#inline_depth++;
 		while (this.#index < this.#text.length) {
 			if (this.#text.charCodeAt(this.#index) === RIGHT_BRACKET) break;
 			if (this.#is_at_paragraph_break()) break;
 			this.#tokenize_inline();
 		}
+		this.#inline_depth--;
 
 		// Check for ]
 		if (this.#index >= this.#text.length || this.#text.charCodeAt(this.#index) !== RIGHT_BRACKET) {
@@ -1622,6 +1712,13 @@ export class MdzLexer {
 	}
 
 	#revert_tokens_from_link_open(start: number): void {
+		// record the failure so a re-lex from before this `[` short-circuits.
+		// Keyed by `start` alone — unlike `#failed_tag`'s `start:bound` — because a
+		// link's outcome is bound-independent: the `]`-terminator scan (the children
+		// loop) runs to `text.length` and never consults `#max_search_index`, so a
+		// wider-bound re-lex can't move it. The bound reaches nested tags inside the
+		// link text, but re-attempting those wider never flips the link's net result.
+		this.#failed_link_starts.add(start);
 		// Find and remove link_text_open and all tokens after it
 		let open_idx = -1;
 		for (let i = this.#tokens.length - 1; i >= 0; i--) {
@@ -1639,6 +1736,32 @@ export class MdzLexer {
 
 	#tokenize_tag(): void {
 		const start = this.#index;
+		// short-circuit a re-attempt of a tag open that already failed at this
+		// offset+bound — re-descending into the same failing children is
+		// exponential on nested same-name tags. Keyed by
+		// `#max_search_index` (captured as `bound`) because the closer search is
+		// bound-sensitive, so a wider-bound re-lex can legitimately succeed. The
+		// key string is built only when the memo is non-empty (adversarial
+		// input); prose never allocates it. The short-circuit reproduces a
+		// revert's exact net effect (`<` text, cursor at start + 1).
+		const bound = this.#max_search_index;
+		if (
+			this.#depth_capped.has(start) ||
+			(this.#failed_tag.size !== 0 && this.#failed_tag.has(`${start}:${bound}`))
+		) {
+			this.#index = start + 1;
+			this.#emit_text('<', start);
+			return;
+		}
+		// nesting-depth cap: too deep to open a tag — render literal and record
+		// the suppression (position-keyed) so a shallower re-lex short-circuits
+		// here too, keeping the revert re-scan linear
+		if (this.#inline_depth >= MAX_INLINE_NESTING_DEPTH) {
+			this.#depth_capped.add(start);
+			this.#index = start + 1;
+			this.#emit_text('<', start);
+			return;
+		}
 		this.#index++; // consume <
 
 		// Tag name must start with a letter
@@ -1685,6 +1808,7 @@ export class MdzLexer {
 
 		// Check for >
 		if (this.#index >= this.#text.length || this.#text.charCodeAt(this.#index) !== RIGHT_ANGLE) {
+			this.#failed_tag.add(`${start}:${bound}`);
 			this.#index = start + 1;
 			this.#emit_text('<', start);
 			return;
@@ -1703,11 +1827,13 @@ export class MdzLexer {
 		const search_limit = Math.min(this.#max_search_index, this.#text.length);
 		const closing_tag_pos = this.#index_of(closing_tag, this.#index);
 		if (closing_tag_pos === -1 || closing_tag_pos > search_limit) {
+			this.#failed_tag.add(`${start}:${bound}`);
 			this.#index = start + 1;
 			this.#emit_text('<', start);
 			return;
 		}
 		if (this.#has_paragraph_break_between(this.#index, closing_tag_pos)) {
+			this.#failed_tag.add(`${start}:${bound}`);
 			this.#index = start + 1;
 			this.#emit_text('<', start);
 			return;
@@ -1723,8 +1849,10 @@ export class MdzLexer {
 		// the code span). Recomputed per iteration because a nested same-name
 		// tag legitimately consumes the nearest closer (`<b>x<b>y</b></b>`).
 		const saved_max = this.#max_search_index;
+		this.#inline_depth++;
 		while (this.#index < this.#text.length) {
 			if (this.#match(closing_tag)) {
+				this.#inline_depth--;
 				this.#max_search_index = saved_max;
 				const close_start = this.#index;
 				this.#index += closing_tag.length;
@@ -1747,12 +1875,14 @@ export class MdzLexer {
 			this.#max_search_index = next_close;
 			this.#tokenize_inline();
 		}
+		this.#inline_depth--;
 
 		// No valid closer left — revert: drop the open token and all consumed
 		// children tokens, emit `<` as text, and re-lex from the next char
 		// (the `#revert_tokens_from_link_open` pattern; the old fallthrough
 		// left a dangling `tag_open` whose parser fallback discarded content)
 		this.#max_search_index = saved_max;
+		this.#failed_tag.add(`${start}:${bound}`);
 		this.#tokens.splice(open_token_index);
 		this.#index = start + 1;
 		this.#emit_text('<', start);
@@ -1780,16 +1910,33 @@ export class MdzLexer {
 		let parts: Array<string> | null = null;
 		let part_start = start;
 
-		while (this.#index < this.#text.length) {
+		// in a table cell the trimmed cell end is a hard stop (no newline to
+		// halt on mid-line) — hoisted to the loop bound
+		const scan_end = this.#in_table_cell
+			? Math.min(this.#max_search_index, this.#text.length)
+			: this.#text.length;
+
+		while (this.#index < scan_end) {
 			const char_code = this.#text.charCodeAt(this.#index);
+			// one table load classifies the char; zero (the common case — the
+			// char can't end or interrupt the run) skips the dispatch below.
+			// `TEXT_SCAN_CLASS` is shared with the streaming scanner
+			// (`consume_text_run` in `mdz_stream_parser_text.ts`); the two dispatch
+			// bodies intentionally differ around it — this one handles `\|` escapes
+			// and list-run strip, that one URL speculation across chunk boundaries.
+			const char_class = char_code < 128 ? TEXT_SCAN_CLASS[char_code]! : 0;
+			if (char_class === 0) {
+				this.#index++;
+				continue;
+			}
+
+			// Stop at special characters
+			if ((char_class & TEXT_CLASS_STOP) !== 0) break;
 
-			// in a table cell: the trimmed cell end is a hard stop (no newline to
-			// halt on mid-line), and `\|` is a literal pipe (the only mdz escape,
-			// scoped here)
-			if (this.#in_table_cell) {
-				if (this.#index >= this.#max_search_index) break;
+			if ((char_class & TEXT_CLASS_BACKSLASH) !== 0) {
+				// `\|` is a literal pipe — the only mdz escape, scoped to table cells
 				if (
-					char_code === BACKSLASH &&
+					this.#in_table_cell &&
 					this.#index + 1 < this.#max_search_index &&
 					this.#text.charCodeAt(this.#index + 1) === PIPE
 				) {
@@ -1799,22 +1946,11 @@ export class MdzLexer {
 					part_start = this.#index;
 					continue;
 				}
+				this.#index++;
+				continue;
 			}
 
-			// Stop at special characters
-			if (
-				char_code === BACKTICK ||
-				char_code === ASTERISK ||
-				char_code === UNDERSCORE ||
-				char_code === TILDE ||
-				char_code === LEFT_BRACKET ||
-				char_code === RIGHT_BRACKET ||
-				char_code === LEFT_ANGLE
-			) {
-				break;
-			}
-
-			if (char_code === NEWLINE) {
+			if ((char_class & TEXT_CLASS_NEWLINE) !== 0) {
 				if (this.#list_run_strip) {
 					if (this.#index >= this.#max_search_index) break; // the run's terminator
 					// soft break: keep the newline, strip the next line's leading
@@ -1853,20 +1989,24 @@ export class MdzLexer {
 						break;
 					}
 				}
+				this.#index++; // single newline — ordinary text
+				continue;
 			}
 
-			// Check for URL or internal path mid-text (char code guard avoids startsWith on every char)
-			if (
-				((char_code === 104 /* h */ || char_code === 72) /* H */ && this.#is_at_url()) ||
-				(char_code === SLASH && is_at_absolute_path(this.#text, this.#index)) ||
-				(char_code === PERIOD && is_at_relative_path(this.#text, this.#index))
-			) {
+			// URL or internal path mid-text (class guard avoids probing every char)
+			if ((char_class & TEXT_CLASS_URL) !== 0) {
+				if (this.#is_at_url()) break;
+			} else if (char_code === SLASH) {
+				if (is_at_absolute_path(this.#text, this.#index)) break;
+			} else if (is_at_relative_path(this.#text, this.#index)) {
 				break;
 			}
 
 			this.#index++;
 		}
 
+		if (mdz_debug_work.enabled) mdz_debug_work.total += this.#index - start;
+
 		// Ensure we always consume at least one character
 		if (this.#index === start && this.#index < this.#text.length) {
 			this.#index++;

package/src/lib/mdz_stream_parser_inline.ts

@@ -339,17 +339,24 @@ export const scan_closer_boundary = (
 /** @nodocs */
 export const try_code = (state: MdzStreamParserState, forced = false): boolean => {
 	const start = state.pos;
-	let i = start + 1; // past opening backtick
+	const search_start = start + 1; // past opening backtick
 
 	// compute search boundary: don't scan past open formatting delimiters
-	const search_limit = code_search_limit(state, start + 1);
+	const search_limit = code_search_limit(state, search_start);
 
-	// scan for closing backtick (must be before newline and search boundary)
-	while (i < state.buffer.length && i < search_limit) {
-		const c = state.buffer.charCodeAt(i);
-		if (c === BACKTICK) {
+	// find the first closing backtick or newline (memoized — a candidate that
+	// holds under open formatting re-enters here on every feed, and a raw scan
+	// would re-cover the same growing region each time, going quadratic on a
+	// single long line)
+	const close_pos = buffer_index_of(state, '`', search_start);
+	const newline_pos = buffer_index_of(state, '\n', search_start);
+	const terminator =
+		close_pos !== -1 && (newline_pos === -1 || close_pos < newline_pos) ? close_pos : newline_pos;
+
+	if (terminator !== -1 && terminator < search_limit) {
+		if (terminator === close_pos) {
 			// found close
-			const content = state.buffer.slice(start + 1, i);
+			const content = state.buffer.slice(search_start, terminator);
 			if (content.length === 0) {
 				// empty code — treat as text
 				consume_delimiter_as_text(state, '``');
@@ -364,20 +371,17 @@ export const try_code = (state: MdzStreamParserState, forced = false): boolean =
 				content,
 				text_type: 'Code',
 				start: offset(state, start),
-				end: offset(state, i + 1),
+				end: offset(state, terminator + 1),
 			});
 			state.active_text_id = null;
-			state.pos = i + 1;
-			state.column += i + 1 - start;
+			state.pos = terminator + 1;
+			state.column += terminator + 1 - start;
 			state.prev_char = BACKTICK;
 			return true;
 		}
-		if (c === NEWLINE) {
-			// inline code can't span lines — treat opening backtick as text
-			consume_delimiter_as_text(state, '`');
-			return true;
-		}
-		i++;
+		// newline before any close — inline code can't span lines
+		consume_delimiter_as_text(state, '`');
+		return true;
 	}
 
 	// hit search limit (open formatting delimiter boundary) — treat backtick as
@@ -386,7 +390,7 @@ export const try_code = (state: MdzStreamParserState, forced = false): boolean =
 	// processed), the one-shot parse rejects that italic and scans unbounded —
 	// see the `MdzStreamParser` TSDoc and the parity suite's expected-divergence
 	// battery
-	if (i < state.buffer.length && i >= search_limit) {
+	if (search_limit < state.buffer.length) {
 		consume_delimiter_as_text(state, '`');
 		return true;
 	}