@fuzdev/mdz 0.2.0 → 0.3.0

package/src/lib/mdz_stream_parser_link.ts

@@ -10,7 +10,7 @@ import {
 	A_UPPER,
 	LEFT_BRACKET,
 	LEFT_PAREN,
-	NEWLINE,
+	MAX_INLINE_NESTING_DEPTH,
 	RIGHT_ANGLE,
 	RIGHT_BRACKET,
 	RIGHT_PAREN,
@@ -28,6 +28,7 @@ import {
 	type TryResult,
 	accumulate_text,
 	alloc_id,
+	buffer_index_of,
 	emit,
 	ensure_paragraph,
 	flush_text,
@@ -37,11 +38,20 @@ import {
 	push_stack_entry,
 	revert_above,
 } from './mdz_stream_parser_state.ts';
+import {consume_delimiter_as_text} from './mdz_stream_parser_text.ts';
+import {mdz_debug_work} from './mdz_debug_work.ts';
 
 // -- Links --
 
 /** @nodocs */
 export const try_link_open = (state: MdzStreamParserState): boolean => {
+	// nesting-depth cap: too deep to open — render `[` literal, matching the
+	// sync lexer's `#tokenize_markdown_link` cap (keeps the two parsers agreeing
+	// on where deep `[` stops nesting)
+	if (state.open_link_tag_depth >= MAX_INLINE_NESTING_DEPTH) {
+		consume_delimiter_as_text(state, '[');
+		return true;
+	}
 	flush_text(state);
 	ensure_paragraph(state);
 
@@ -97,65 +107,69 @@ export const try_complete_link = (state: MdzStreamParserState, link_stack_idx: n
 		return true;
 	}
 
-	// found ]( — scan for )
-	let i = bracket_pos + 2; // past ](
-	while (i < state.buffer.length) {
-		const c = state.buffer.charCodeAt(i);
-		if (c === RIGHT_PAREN) {
-			const reference = state.buffer.slice(bracket_pos + 2, i);
-			// validate reference: non-empty and only valid path chars
-			if (!reference.trim()) {
-				abort_link_to_text(state, link_stack_idx, bracket_pos);
-				return true;
-			}
-			let valid = true;
-			for (let j = 0; j < reference.length; j++) {
-				if (!is_valid_path_char(reference.charCodeAt(j))) {
-					valid = false;
-					break;
-				}
-			}
-			if (!valid) {
-				abort_link_to_text(state, link_stack_idx, bracket_pos);
-				return true;
-			}
-			// Reject unsafe protocols (javascript:, data:, etc.) at parse time.
-			// `is_valid_path_char` permits `:` so we have to filter explicitly.
-			if (!mdz_is_safe_reference(reference)) {
-				abort_link_to_text(state, link_stack_idx, bracket_pos);
-				return true;
-			}
-
-			// success — close the link with reference
-			flush_text(state);
-			revert_above(state, link_stack_idx);
-			const entry = pop_stack_entry(state);
-			const link_type = mdz_is_url(reference) ? 'external' : 'internal';
-			emit(state, {
-				type: 'close',
-				id: entry.id,
-				end: offset(state, i + 1),
-				reference,
-				link_type,
-			});
-			state.active_text_id = null;
-			state.pos = i + 1;
-			state.column += i + 1 - bracket_pos;
-			state.prev_char = RIGHT_PAREN;
+	// found ]( — find the reference's terminator: `)` completes, a space or
+	// newline aborts. Memoized searches (see `buffer_index_of`) — a link whose
+	// URL arrives incrementally re-enters here on every feed with `pos` still
+	// at the `]`, and a raw scan would re-cover the growing reference each
+	// time, going quadratic on long streamed URLs.
+	const ref_start = bracket_pos + 2;
+	const close_pos = buffer_index_of(state, ')', ref_start);
+	const space_pos = buffer_index_of(state, ' ', ref_start);
+	const newline_pos = buffer_index_of(state, '\n', ref_start);
+	let invalid_pos = space_pos;
+	if (newline_pos !== -1 && (invalid_pos === -1 || newline_pos < invalid_pos)) {
+		invalid_pos = newline_pos;
+	}
+
+	if (close_pos === -1) {
+		// didn't find ) — need more input or invalid
+		if (invalid_pos === -1) return false; // need more input
+		// found invalid char before any ) — revert
+		abort_link_to_text(state, link_stack_idx, bracket_pos);
+		return true;
+	}
+	if (invalid_pos !== -1 && invalid_pos < close_pos) {
+		// invalid character in URL (simplified check)
+		abort_link_to_text(state, link_stack_idx, bracket_pos);
+		return true;
+	}
+
+	const i = close_pos;
+	const reference = state.buffer.slice(ref_start, i);
+	// validate reference: non-empty and only valid path chars
+	if (!reference.trim()) {
+		abort_link_to_text(state, link_stack_idx, bracket_pos);
+		return true;
+	}
+	for (let j = 0; j < reference.length; j++) {
+		if (!is_valid_path_char(reference.charCodeAt(j))) {
+			abort_link_to_text(state, link_stack_idx, bracket_pos);
 			return true;
 		}
-		if (c === NEWLINE || c === SPACE) {
-			// invalid character in URL (simplified check)
-			break;
-		}
-		i++;
+	}
+	// Reject unsafe protocols (javascript:, data:, etc.) at parse time.
+	// `is_valid_path_char` permits `:` so we have to filter explicitly.
+	if (!mdz_is_safe_reference(reference)) {
+		abort_link_to_text(state, link_stack_idx, bracket_pos);
+		return true;
 	}
 
-	// didn't find ) — need more input or invalid
-	if (i >= state.buffer.length) return false; // need more input
-
-	// found invalid char before ) — revert
-	abort_link_to_text(state, link_stack_idx, bracket_pos);
+	// success — close the link with reference
+	flush_text(state);
+	revert_above(state, link_stack_idx);
+	const entry = pop_stack_entry(state);
+	const link_type = mdz_is_url(reference) ? 'external' : 'internal';
+	emit(state, {
+		type: 'close',
+		id: entry.id,
+		end: offset(state, i + 1),
+		reference,
+		link_type,
+	});
+	state.active_text_id = null;
+	state.pos = i + 1;
+	state.column += i + 1 - bracket_pos;
+	state.prev_char = RIGHT_PAREN;
 	return true;
 };
 
@@ -176,7 +190,19 @@ export const try_tag_open = (state: MdzStreamParserState): TryResult => {
 		return 'not_match';
 	}
 
+	// nesting-depth cap: `<letter…` is a tag open, but we're too deep to nest —
+	// render `<` literal, matching the sync lexer's `#tokenize_tag` cap. Checked
+	// after the closer/hold cases above (a `</…>` closer still closes; a `<` at
+	// the buffer end still holds), so only genuine opens are suppressed.
+	if (state.open_link_tag_depth >= MAX_INLINE_NESTING_DEPTH) {
+		consume_delimiter_as_text(state, '<');
+		return 'consumed';
+	}
+
 	// collect tag name
+	// TODO the name/whitespace scans rescan from `start` on every held retry
+	// of an unclosed tag's open tail — needs a hold watermark; a length cap would
+	// diverge from the sync parser on pathological multi-KB "tag names"
 	const name_start = i;
 	while (i < state.buffer.length && is_tag_name_char(state.buffer.charCodeAt(i))) {
 		i++;
@@ -255,9 +281,16 @@ export const try_close_tag = (state: MdzStreamParserState): TryResult => {
 	const name = state.buffer.slice(name_start, i);
 	i++; // past >
 
+	// O(1) bail when no tag of this name is open — without it, every `</name>`
+	// candidate walks the whole inline stack, which grows one frame per leaked
+	// unclosed `<Tag>` and goes quadratic on tag-dense input (the same shape
+	// `open_counts` guards for the delimiter inlines)
+	if (!state.open_tag_counts?.get(name)) return 'not_match';
+
 	// find matching open tag on stack
 	let found_idx = -1;
 	for (let j = state.stack.length - 1; j >= 0; j--) {
+		if (mdz_debug_work.enabled) mdz_debug_work.total++; // frames walked (mismatched-tags guard)
 		const entry = state.stack[j]!;
 		if (
 			(entry.node_type === 'Element' || entry.node_type === 'Component') &&

package/src/lib/mdz_stream_parser_list.ts

@@ -418,10 +418,16 @@ export const process_list_line = (
 
 	if (marker !== null && marker.empty) {
 		// empty item: only at an indent exactly matching an open level of the
-		// same marker type — anything else degrades below
-		const level_idx = state.list_levels.findIndex(
-			(l) => l.indent === indent && l.ordered === marker.ordered,
-		);
+		// same marker type — anything else degrades below (manual loop like
+		// `list_continuation_target` — no per-line closure allocation)
+		let level_idx = -1;
+		for (let li = 0; li < state.list_levels.length; li++) {
+			const l = state.list_levels[li]!;
+			if (l.indent === indent && l.ordered === marker.ordered) {
+				level_idx = li;
+				break;
+			}
+		}
 		if (level_idx !== -1) {
 			close_list_run(state);
 			while (state.list_levels.length - 1 > level_idx) {

package/src/lib/mdz_stream_parser_state.ts

@@ -9,7 +9,9 @@
  */
 
 import type {MdzNodeTypeContainer, MdzNodeId, MdzOpcode} from './mdz_opcodes.ts';
+import type {MdzTableCellParser} from './mdz.ts';
 import {NEWLINE, has_non_whitespace, mdz_heading_id_from_text} from './mdz_helpers.ts';
+import {mdz_debug_work} from './mdz_debug_work.ts';
 
 /**
  * Tri-state result for `try_*` parser handlers.
@@ -214,8 +216,9 @@ export interface MdzStreamParserState {
 	 * is `null` for a top-level table (column-0 rows) or the enclosing list item's
 	 * marker indent for a table nested as a block child (rows skip the indent and
 	 * a dedent to that indent ends the table, returning control to the list).
+	 * `cell_parser` is the table's shared cell parser, rebound per row.
 	 */
-	table: {id: MdzNodeId; item_indent: number | null} | null;
+	table: {id: MdzNodeId; item_indent: number | null; cell_parser: MdzTableCellParser} | null;
 	/**
 	 * Whether the innermost open ListItem's first inline run is current.
 	 * Content then flows directly into the ListItem frame — the sync AST
@@ -243,6 +246,32 @@ export interface MdzStreamParserState {
 	search_memo: Map<string, BufferSearchMemo> | null;
 	/** Open-container counts for `find_open`'s O(1) "nothing open" early exit. */
 	open_counts: OpenInlineCounts;
+	/**
+	 * Count of open `Link`/`Element`/`Component` frames in the current run — the
+	 * streaming analogue of the sync lexer's `#inline_depth`. Kept as an O(1)
+	 * counter (not a stack walk, which would reintroduce the deep-stack
+	 * quadratic `open_counts` exists to avoid) so `try_link_open`/`try_tag_open`
+	 * can cap nesting at `MAX_INLINE_NESTING_DEPTH` — rendering a deeper `[`/`<`
+	 * literal, matching the sync cap on pure/symmetric nesting. It counts
+	 * **optimistic** opens, though, so it diverges from the sync `#inline_depth`
+	 * (which the sync tag path only bumps after a closer precheck) on an
+	 * asymmetric cap-saturating prefix — 100+ *unclosed* `<a>` before a valid
+	 * `[x](/u)` saturates this counter and suppresses the trailing link that sync
+	 * still forms. Adversarial-only, documented not fixed (streaming can't
+	 * precheck closers): see the flip-at-cap case in `mdz_nesting_cap.test.ts`.
+	 * Run-scoped for free like `open_counts`: a
+	 * run close reverts every inline frame above it, decrementing back to zero.
+	 */
+	open_link_tag_depth: number;
+	/**
+	 * Per-name counts of open Element/Component frames, the tag analogue of
+	 * `open_counts`: `try_close_tag` bails in O(1) when the closing name isn't
+	 * open, instead of walking a stack that grows one frame per leaked unclosed
+	 * `<Tag>`. Lazily created on the first tag open — tag-free inputs never
+	 * allocate the map. Run-scoped like `open_counts`: run closes revert every
+	 * inline frame above them, decrementing the counts back to zero.
+	 */
+	open_tag_counts: Map<string, number> | null;
 	/** Whether we're inside a heading (newline ends it). */
 	in_heading: boolean;
 	/** Whether we're inside an optimistic inline Code container. */
@@ -315,6 +344,8 @@ export const create_state = (): MdzStreamParserState => ({
 	base_offset: 0,
 	search_memo: null,
 	open_counts: {Bold: 0, Italic: 0, Strikethrough: 0, Link: 0},
+	open_link_tag_depth: 0,
+	open_tag_counts: null,
 	in_heading: false,
 	in_code: false,
 	in_paragraph: false,
@@ -362,6 +393,13 @@ export const push_stack_entry = (
 	} else {
 		bump_open_count(state, node_type, 1);
 	}
+	if (tag_name !== undefined) {
+		const counts = (state.open_tag_counts ??= new Map());
+		counts.set(tag_name, (counts.get(tag_name) ?? 0) + 1);
+	}
+	// Link/Element/Component contribute to the nesting-depth cap (tag_name is
+	// set for Element/Component only, so `Link || tag_name` is exactly the three)
+	if (node_type === 'Link' || tag_name !== undefined) state.open_link_tag_depth++;
 };
 
 /**
@@ -394,6 +432,16 @@ const bump_open_count = (
 export const pop_stack_entry = (state: MdzStreamParserState): StackEntry => {
 	const entry = state.stack.pop()!;
 	bump_open_count(state, entry.node_type, -1);
+	if (entry.tag_name !== undefined) {
+		const counts = state.open_tag_counts!;
+		// drop zero-count keys so a long stream of many distinct tag names can't
+		// grow the map unboundedly — the `!counts.get(name)` bail in `try_close_tag`
+		// treats a missing key and a 0 count identically, so this is behavior-neutral
+		const remaining = counts.get(entry.tag_name)! - 1;
+		if (remaining === 0) counts.delete(entry.tag_name);
+		else counts.set(entry.tag_name, remaining);
+	}
+	if (entry.node_type === 'Link' || entry.tag_name !== undefined) state.open_link_tag_depth--;
 	return entry;
 };
 
@@ -465,7 +513,11 @@ const memo_index_of = (
 			// rescan only the appended tail, overlapping the old boundary so a
 			// straddling needle isn't missed
 			const rescan_from = Math.max(global_from, memo.searched_to - (needle.length - 1));
-			const result = state.buffer.indexOf(needle, rescan_from - state.base_offset);
+			const local_from = rescan_from - state.base_offset;
+			const result = state.buffer.indexOf(needle, local_from);
+			if (mdz_debug_work.enabled) {
+				mdz_debug_work.total += (result === -1 ? state.buffer.length : result) - local_from;
+			}
 			memo.from = global_from;
 			memo.result = result === -1 ? -1 : state.base_offset + result;
 			memo.searched_to = global_end;
@@ -474,6 +526,9 @@ const memo_index_of = (
 		// found result already behind `from` — fall through to a fresh scan
 	}
 	const result = state.buffer.indexOf(needle, from);
+	if (mdz_debug_work.enabled) {
+		mdz_debug_work.total += (result === -1 ? state.buffer.length : result) - from;
+	}
 	memo.from = global_from;
 	memo.result = result === -1 ? -1 : state.base_offset + result;
 	memo.searched_to = global_end;
@@ -519,8 +574,13 @@ export const emit = (state: MdzStreamParserState, op: MdzOpcode): void => {
 		if (top) {
 			top.has_children = true;
 			// propagate non-whitespace marker to the nearest Paragraph so
-			// whitespace-only paragraphs can be discarded at close
-			if (op.type === 'void' || has_non_whitespace(op.content)) {
+			// whitespace-only paragraphs can be discarded at close — the O(1)
+			// no-paragraph check runs first so codeblock/table-cell emissions
+			// (never inside a Paragraph) skip the content scan entirely
+			if (
+				op.type === 'void' ||
+				(state.paragraph_stack_idx !== -1 && has_non_whitespace(op.content))
+			) {
 				mark_paragraph_non_whitespace(state);
 			}
 		}
@@ -744,6 +804,18 @@ export const revert_failed_close = (state: MdzStreamParserState, stack_idx: numb
 	const frames_above = state.stack.length - 1 - stack_idx;
 	state.stack.splice(stack_idx, 1);
 	bump_open_count(state, entry.node_type, -1);
+	if (entry.tag_name !== undefined) {
+		const counts = state.open_tag_counts!;
+		// drop zero-count keys so a long stream of many distinct tag names can't
+		// grow the map unboundedly — the `!counts.get(name)` bail in `try_close_tag`
+		// treats a missing key and a 0 count identically, so this is behavior-neutral
+		const remaining = counts.get(entry.tag_name)! - 1;
+		if (remaining === 0) counts.delete(entry.tag_name);
+		else counts.set(entry.tag_name, remaining);
+	}
+	// only ever reverts an Italic today, but keep the depth counter honest if a
+	// Link/Element/Component is ever failed-closed mid-stack
+	if (entry.node_type === 'Link' || entry.tag_name !== undefined) state.open_link_tag_depth--;
 	state.opcodes.push({
 		type: 'revert',
 		id: entry.id,

package/src/lib/mdz_stream_parser_table.ts

@@ -7,8 +7,9 @@
  * whole header emits at once. Body rows then stream one per line. Because a row
  * is always fully buffered before it emits (no within-row streaming), each
  * cell's inline content is parsed with the sync reference (`MdzTableCellParser`,
- * one `MdzLexer`/`MdzTokenParser` shared across the row's cells) and replayed
- * as opcodes — guaranteeing sync↔stream parity by construction.
+ * one `MdzLexer`/`MdzTokenParser` shared across the whole table's cells,
+ * rebound per row) and replayed as opcodes — guaranteeing sync↔stream parity
+ * by construction.
  *
  * @module
  */
@@ -72,7 +73,11 @@ export const try_table_start = (state: MdzStreamParserState, forced: boolean): T
 	const table_start = offset(state, start);
 	emit(state, {type: 'open', id: table_id, node_type: 'Table', start: table_start, align});
 	push_stack_entry(state, table_id, 'Table', table_start);
-	state.table = {id: table_id, item_indent: null};
+	state.table = {
+		id: table_id,
+		item_indent: null,
+		cell_parser: new MdzTableCellParser(state.buffer),
+	};
 
 	emit_table_row(state, header_cells, true, start, header_end);
 
@@ -280,7 +285,11 @@ export const open_table_in_item = (
 		align: head.align,
 	});
 	push_stack_entry(state, table_id, 'Table', table_start);
-	state.table = {id: table_id, item_indent: marker_indent};
+	state.table = {
+		id: table_id,
+		item_indent: marker_indent,
+		cell_parser: new MdzTableCellParser(state.buffer),
+	};
 	emit_table_row(state, head.header_cells, true, header_first, head.header_end);
 	// leave the cursor on the delimiter's newline (or EOF) — the in-item body-row
 	// handler reads from the line after it and hands back on this same convention
@@ -301,9 +310,11 @@ const emit_table_row = (
 	const row_off = offset(state, row_start);
 	emit(state, {type: 'open', id: row_id, node_type: 'TableRow', start: row_off, header});
 	push_stack_entry(state, row_id, 'TableRow', row_off);
-	// one lexer/parser shared across the row's cells (all index into the same
-	// buffer) rather than allocated per cell
-	const cell_parser = new MdzTableCellParser(state.buffer);
+	// one lexer/parser shared across the whole table rather than allocated per
+	// row (or per cell) — rebound per row because the buffer string changes
+	// across feeds; the lexer's search memo survives when it doesn't
+	const cell_parser = state.table!.cell_parser;
+	cell_parser.rebind(state.buffer);
 	for (const cell of cells) {
 		emit_table_cell(state, cell_parser, cell.start, cell.end);
 	}

package/src/lib/mdz_stream_parser_text.ts

@@ -5,21 +5,15 @@
  */
 
 import {
-	ASTERISK,
-	BACKTICK,
 	HTTPS_PREFIX_LENGTH,
-	H_LOWER,
-	H_UPPER,
-	LEFT_ANGLE,
-	LEFT_BRACKET,
 	NEWLINE,
-	PERIOD,
-	RIGHT_BRACKET,
-	SLASH,
 	SPACE,
 	TAB,
-	TILDE,
-	UNDERSCORE,
+	TEXT_CLASS_NEWLINE,
+	TEXT_CLASS_PATH,
+	TEXT_CLASS_STOP,
+	TEXT_CLASS_URL,
+	TEXT_SCAN_CLASS,
 	is_word_char,
 	match_url_prefix_case_insensitive,
 } from './mdz_helpers.ts';
@@ -29,6 +23,7 @@ import {
 	ensure_paragraph,
 	offset,
 } from './mdz_stream_parser_state.ts';
+import {mdz_debug_work} from './mdz_debug_work.ts';
 
 /**
  * Consume a delimiter at the current position as literal text — the shared
@@ -60,35 +55,41 @@ export const consume_text_run = (state: MdzStreamParserState): void => {
 	state.pos++;
 	while (state.pos < state.buffer.length) {
 		const c = state.buffer.charCodeAt(state.pos);
-		if (
-			c === BACKTICK ||
-			c === ASTERISK ||
-			c === UNDERSCORE ||
-			c === TILDE ||
-			c === LEFT_BRACKET ||
-			c === RIGHT_BRACKET ||
-			c === LEFT_ANGLE ||
-			c === NEWLINE ||
-			// URL/path: only break when actually at a URL or path start.
-			// Most h/H/./slash in prose are not URLs/paths — continuing the scan
-			// avoids the full dispatch cycle through process_loop → process_inline.
-			// For `h`/`H` at a word boundary, also break when there isn't enough
-			// buffer left to confirm `https://` / `http://` — process_inline's
-			// speculator then carries the prefix match across chunk boundaries.
-			// Scheme matching is case-insensitive (RFC 3986).
-			((c === H_LOWER || c === H_UPPER) &&
-				(match_url_prefix_case_insensitive(state.buffer, state.pos) > 0 ||
-					(state.buffer.length - state.pos < HTTPS_PREFIX_LENGTH &&
-						!is_word_char(state.buffer.charCodeAt(state.pos - 1))))) ||
-			((c === SLASH || c === PERIOD) &&
-				(state.buffer.charCodeAt(state.pos - 1) === SPACE ||
-					state.buffer.charCodeAt(state.pos - 1) === NEWLINE ||
-					state.buffer.charCodeAt(state.pos - 1) === TAB))
-		) {
-			break;
+		// one table load classifies the char; zero (the common case) continues
+		// the run without any further checks. `TEXT_SCAN_CLASS` is shared with
+		// the sync lexer's `#tokenize_text` (`mdz_lexer.ts`); the dispatch bodies
+		// intentionally differ — that one handles `\|` escapes and list-run
+		// strip, this one URL speculation across chunk boundaries.
+		const char_class = c < 128 ? TEXT_SCAN_CLASS[c]! : 0;
+		if (char_class === 0) {
+			state.pos++;
+			continue;
 		}
+		if ((char_class & (TEXT_CLASS_STOP | TEXT_CLASS_NEWLINE)) !== 0) break;
+		if ((char_class & TEXT_CLASS_URL) !== 0) {
+			// URL: only break when actually at a URL start. Most h/H in prose are
+			// not URLs — continuing the scan avoids the full dispatch cycle
+			// through process_loop → process_inline. At a word boundary, also
+			// break when there isn't enough buffer left to confirm `https://` /
+			// `http://` — process_inline's speculator then carries the prefix
+			// match across chunk boundaries. Scheme matching is case-insensitive
+			// (RFC 3986).
+			if (
+				match_url_prefix_case_insensitive(state.buffer, state.pos) > 0 ||
+				(state.buffer.length - state.pos < HTTPS_PREFIX_LENGTH &&
+					!is_word_char(state.buffer.charCodeAt(state.pos - 1)))
+			) {
+				break;
+			}
+		} else if ((char_class & TEXT_CLASS_PATH) !== 0) {
+			// path (`/` or `.`): only break at a plausible path start
+			const prev = state.buffer.charCodeAt(state.pos - 1);
+			if (prev === SPACE || prev === NEWLINE || prev === TAB) break;
+		}
+		// backslash (or a non-starting path char) — ordinary text
 		state.pos++;
 	}
+	if (mdz_debug_work.enabled) mdz_debug_work.total += state.pos - start;
 	accumulate_text(state, state.buffer.slice(start, state.pos), offset(state, start));
 	state.prev_char = state.buffer.charCodeAt(state.pos - 1);
 	state.column += state.pos - start;

package/src/lib/mdz_to_svelte.ts

@@ -13,7 +13,7 @@ import {escape_svelte_text} from '@fuzdev/fuz_util/svelte_preprocess_helpers.ts'
 import {escape_js_string} from '@fuzdev/fuz_util/string.ts';
 
 import type {MdzNode, MdzNodeTableRow} from './mdz.ts';
-import {mdz_resolve_relative_path, mdz_is_void_element} from './mdz_helpers.ts';
+import {mdz_is_void_element, mdz_classify_link} from './mdz_helpers.ts';
 
 /**
  * Result of converting `MdzNode` arrays to Svelte markup.
@@ -131,26 +131,21 @@ export const mdz_to_svelte = (
 
 			case 'Link': {
 				const children_markup = render_nodes(node.children);
-				if (node.link_type === 'internal') {
-					if (node.reference.startsWith('.') && base) {
-						const resolved = mdz_resolve_relative_path(node.reference, base);
-						imports.set('resolve', {path: '$app/paths', kind: 'named'});
-						return `<a href={resolve('${escape_js_string(resolved)}')}>${children_markup}</a>`;
-					}
-					if (
-						node.reference.startsWith('#') ||
-						node.reference.startsWith('?') ||
-						node.reference.startsWith('.') ||
-						// Bare references (e.g. `foo`) aren't absolute — resolve() throws on them
-						!node.reference.startsWith('/')
-					) {
-						return `<a href={'${escape_js_string(node.reference)}'}>${children_markup}</a>`;
-					}
+				// safety gate + resolve-vs-raw classification shared with the runtime
+				// views via `mdz_classify_link`, so the three renderers can't drift
+				// (an unsafe `javascript:`/`data:` ref renders as plain children, no
+				// `<a>` — defense in depth, since `mdz_to_svelte` is a public entry
+				// callable with hand-built trees that never went through `mdz_parse`)
+				const link = mdz_classify_link(node.reference, node.link_type, base);
+				if (link.kind === 'unsafe') return children_markup;
+				if (link.kind === 'resolve') {
 					imports.set('resolve', {path: '$app/paths', kind: 'named'});
-					return `<a href={resolve('${escape_js_string(node.reference)}')}>${children_markup}</a>`;
+					return `<a href={resolve('${escape_js_string(link.href)}')}>${children_markup}</a>`;
+				}
+				if (link.kind === 'external') {
+					return `<a href={'${escape_js_string(link.href)}'} target="_blank" rel="noopener">${children_markup}</a>`;
 				}
-				// External link — matches MdzNodeView: target="_blank" rel="noopener"
-				return `<a href={'${escape_js_string(node.reference)}'} target="_blank" rel="noopener">${children_markup}</a>`;
+				return `<a href={'${escape_js_string(link.href)}'}>${children_markup}</a>`;
 			}
 
 			case 'Paragraph':
@@ -184,19 +179,16 @@ export const mdz_to_svelte = (
 					}
 					return `<tr>${cells}</tr>`;
 				};
+				// by grammar the header row is always first (and the only one) —
+				// read it by index and skip it in the body, mirroring the node
+				// views (a `.filter()` pair re-partitions every row; see
+				// `MdzNodeView.svelte`'s "Table rendering de-quadratified" note)
 				let out = '<table>';
-				const header_rows = node.children.filter((r) => r.header);
-				const body_rows = node.children.filter((r) => !r.header);
-				if (header_rows.length > 0) {
-					out += '<thead>';
-					for (const row of header_rows) out += render_row(row, 'th');
-					out += '</thead>';
-				}
-				if (body_rows.length > 0) {
-					out += '<tbody>';
-					for (const row of body_rows) out += render_row(row, 'td');
-					out += '</tbody>';
-				}
+				const header_row = node.children[0]?.header ? node.children[0] : undefined;
+				if (header_row) out += '<thead>' + render_row(header_row, 'th') + '</thead>';
+				let body = '';
+				for (const row of node.children) if (!row.header) body += render_row(row, 'td');
+				if (body) out += '<tbody>' + body + '</tbody>';
 				return out + '</table>';
 			}
 

package/src/lib/mdz_token_parser.ts

@@ -46,6 +46,21 @@ import {
 	type MdzTokenTableCellOpen,
 } from './mdz_lexer.ts';
 
+/**
+ * Whether a token type ends the current inline context — the block-boundary
+ * set shared by the delimiter-pair and link children loops (an unclosed
+ * inline never swallows block structure).
+ */
+const token_is_block_boundary = (type: MdzToken['type']): boolean =>
+	type === 'paragraph_break' ||
+	type === 'heading_start' ||
+	type === 'hr' ||
+	type === 'codeblock' ||
+	type === 'list_open' ||
+	type === 'list_item_close' ||
+	type === 'blockquote_open' ||
+	type === 'table_open';
+
 /**
  * Builds an `MdzNode[]` tree from a lexed `MdzToken[]` stream.
  * Used by `mdz_parse`, which should be preferred for simple usage.
@@ -490,16 +505,7 @@ export class MdzTokenParser {
 				this.#index++;
 				return {type: node_type, children, start, end: t.end};
 			}
-			if (
-				t.type === 'paragraph_break' ||
-				t.type === 'heading_start' ||
-				t.type === 'hr' ||
-				t.type === 'codeblock' ||
-				t.type === 'list_open' ||
-				t.type === 'list_item_close' ||
-				t.type === 'blockquote_open' ||
-				t.type === 'table_open'
-			) {
+			if (token_is_block_boundary(t.type)) {
 				break;
 			}
 			const node = this.#parse_inline();
@@ -539,16 +545,7 @@ export class MdzTokenParser {
 				// No link_ref - treat as text
 				return {type: 'Text', content: '[', start, end: start + 1};
 			}
-			if (
-				t.type === 'paragraph_break' ||
-				t.type === 'heading_start' ||
-				t.type === 'hr' ||
-				t.type === 'codeblock' ||
-				t.type === 'list_open' ||
-				t.type === 'list_item_close' ||
-				t.type === 'blockquote_open' ||
-				t.type === 'table_open'
-			) {
+			if (token_is_block_boundary(t.type)) {
 				break;
 			}
 			const node = this.#parse_inline();