@fuzdev/mdz 0.4.0 → 0.5.0

package/dist/mdz_to_svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mdz_to_svelte.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_to_svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAmB,MAAM,UAAU,CAAC;AAGzD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IAEf,yDAAyD;IACzD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IAElE,yEAAyE;IACzE,qBAAqB,EAAE,OAAO,CAAC;CAC/B;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnC;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GACzB,OAAO,KAAK,CAAC,OAAO,CAAC,EACrB,SAAS,kBAAkB,KACzB,iBAsJF,CAAC"}
+{"version":3,"file":"mdz_to_svelte.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_to_svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAmB,MAAM,UAAU,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAe3D;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAUtF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IAEf,yDAAyD;IACzD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IAElE,yEAAyE;IACzE,qBAAqB,EAAE,OAAO,CAAC;CAC/B;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAE/C;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GACzB,OAAO,KAAK,CAAC,OAAO,CAAC,EACrB,SAAS,kBAAkB,KACzB,iBAmKF,CAAC"}

package/dist/mdz_to_svelte.js

@@ -10,7 +10,14 @@
 import { UnreachableError } from '@fuzdev/fuz_util/error.ts';
 import { escape_svelte_text } from '@fuzdev/fuz_util/svelte_preprocess_helpers.ts';
 import { escape_js_string } from '@fuzdev/fuz_util/string.ts';
-import { mdz_is_void_element, mdz_classify_link } from './mdz_helpers.js';
+import { mdz_is_void_element, mdz_classify_link, mdz_filter_element_attributes, mdz_filter_component_attributes, ALLOWED_ELEMENT_ATTRIBUTES } from './mdz_helpers.js';
+const format_attributes = (entries) => {
+    let out = '';
+    for (const [name, value] of entries) {
+        out += value === true ? ` ${name}={true}` : ` ${name}={'${escape_js_string(value)}'}`;
+    }
+    return out;
+};
 /** Derives an import's local identifier from a `.svelte` import path's basename. */
 const component_local_name = (import_path) => import_path.slice(import_path.lastIndexOf('/') + 1).replace(/\.svelte$/, '');
 /**
@@ -68,7 +75,7 @@ export const mdz_to_svelte = (nodes, options) => {
                     return children_markup;
                 if (link.kind === 'resolve') {
                     imports.set('resolve', { path: '$app/paths', kind: 'named' });
-                    return `<a href={resolve('${escape_js_string(link.href)}')}>${children_markup}</a>`;
+                    return `<a href={resolve('${escape_js_string(link.path)}')}>${children_markup}</a>`;
                 }
                 if (link.kind === 'external') {
                     return `<a href={'${escape_js_string(link.href)}'} target="_blank" rel="noopener">${children_markup}</a>`;
@@ -130,24 +137,30 @@ export const mdz_to_svelte = (nodes, options) => {
                 return `<h${node.level}${id_attr}>${render_nodes(node.children)}</h${node.level}>`;
             }
             case 'Element': {
-                if (elements[node.name] === undefined) {
+                if (elements[node.name] !== true) {
                     has_unconfigured_tags = true;
                     return '';
                 }
+                // filter via the SAME helper the node views use, so precompiled and
+                // runtime output stay identical (its DEV-warn fires at build time too)
+                const attrs_str = format_attributes(Object.entries(mdz_filter_element_attributes(node.name, node.attributes, ALLOWED_ELEMENT_ATTRIBUTES)));
                 if (mdz_is_void_element(node.name)) {
                     // void elements cannot have content — any parsed children are dropped
-                    return `<${node.name} />`;
+                    return `<${node.name}${attrs_str} />`;
                 }
-                return `<${node.name}>${render_nodes(node.children)}</${node.name}>`;
+                return `<${node.name}${attrs_str}>${render_nodes(node.children)}</${node.name}>`;
             }
             case 'Component': {
-                const import_path = components[node.name];
-                if (!import_path) {
+                const entry = components[node.name];
+                if (!entry) {
                     has_unconfigured_tags = true;
                     return '';
                 }
-                imports.set(node.name, { path: import_path, kind: 'default' });
-                return `<${node.name}>${render_nodes(node.children)}</${node.name}>`;
+                const { path, props } = typeof entry === 'string' ? { path: entry, props: undefined } : entry;
+                imports.set(node.name, { path, kind: 'default' });
+                // filter via the SAME helper the node views use
+                const attrs_str = format_attributes(Object.entries(mdz_filter_component_attributes(node.name, node.attributes, props)));
+                return `<${node.name}${attrs_str}>${render_nodes(node.children)}</${node.name}>`;
             }
             default:
                 throw new UnreachableError(node);

package/dist/mdz_token_parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mdz_token_parser.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_token_parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACX,OAAO,EAeP,MAAM,UAAU,CAAC;AAQlB,OAAO,EACN,KAAK,QAAQ,EAYb,MAAM,gBAAgB,CAAC;AAiBxB;;;GAGG;AACH,qBAAa,cAAc;;gBAId,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;IAInC;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI;IAKpC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC;IAIvB;;;;;;OAMG;IACH,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC;CA+iBlC"}
+{"version":3,"file":"mdz_token_parser.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/mdz_token_parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACX,OAAO,EAeP,MAAM,UAAU,CAAC;AAQlB,OAAO,EACN,KAAK,QAAQ,EAYb,MAAM,gBAAgB,CAAC;AAiBxB;;;GAGG;AACH,qBAAa,cAAc;;gBAId,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;IAInC;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI;IAKpC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC;IAIvB;;;;;;OAMG;IACH,gBAAgB,IAAI,KAAK,CAAC,OAAO,CAAC;CA6jBlC"}

package/dist/mdz_token_parser.js

@@ -478,7 +478,14 @@ export class MdzTokenParser {
             const t = this.#tokens[this.#index];
             if (t.type === 'tag_close' && t.name === tag_name) {
                 this.#index++;
-                return { type: node_type, name: tag_name, children, start, end: t.end };
+                return {
+                    type: node_type,
+                    name: tag_name,
+                    attributes: open_token.attributes,
+                    children,
+                    start,
+                    end: t.end
+                };
             }
             const node = this.#parse_inline();
             if (node)
@@ -491,7 +498,14 @@ export class MdzTokenParser {
         const token = this.#tokens[this.#index];
         const node_type = token.is_component ? 'Component' : 'Element';
         this.#index++;
-        return { type: node_type, name: token.name, children: [], start: token.start, end: token.end };
+        return {
+            type: node_type,
+            name: token.name,
+            attributes: token.attributes,
+            children: [],
+            start: token.start,
+            end: token.end
+        };
     }
     // -- Paragraph flushing --
     #flush_paragraph(paragraph_children, trim_trailing = false) {

package/dist/svelte_preprocess_mdz.d.ts

@@ -14,6 +14,7 @@
  * @module
  */
 import { type PreprocessorGroup } from 'svelte/compiler';
+import { type MdzComponentImport } from './mdz_to_svelte.js';
 /**
  * Options for `svelte_preprocess_mdz`.
  */
@@ -23,12 +24,14 @@ export interface SveltePreprocessMdzOptions {
     /**
      * Component import mapping for mdz content.
      * Key: component name as used in mdz (e.g., 'Alert').
-     * Value: import path (e.g., '#lib/Alert.svelte').
+     * Value: import path (e.g., '#lib/Alert.svelte'), which receives no attributes,
+     * or `{path, props}` naming the attributes passed as props
+     * (e.g., `{path: '#lib/Alert.svelte', props: ['status']}`, or `props: 'all'`).
      *
      * If mdz content references a component not in this map,
      * that `Mdz` usage is skipped (left as runtime).
      */
-    components?: Record<string, string>;
+    components?: Record<string, MdzComponentImport>;
     /**
      * Allowed HTML elements in mdz content (e.g., `{aside: true, details: true}`).
      * Values are boolean placeholders for future per-element configuration,

package/dist/svelte_preprocess_mdz.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"svelte_preprocess_mdz.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/svelte_preprocess_mdz.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAS,KAAK,iBAAiB,EAAY,MAAM,iBAAiB,CAAC;AA+B1E;;GAEG;AACH,MAAM,WAAW,0BAA0B;IAC1C,gCAAgC;IAChC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAEjC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;CAC3B;AAID;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,UAAS,0BAA+B,KACtC,iBA6FF,CAAC"}
+{"version":3,"file":"svelte_preprocess_mdz.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/svelte_preprocess_mdz.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAS,KAAK,iBAAiB,EAAY,MAAM,iBAAiB,CAAC;AAsB1E,OAAO,EAAiB,KAAK,kBAAkB,EAA0B,MAAM,oBAAoB,CAAC;AASpG;;GAEG;AACH,MAAM,WAAW,0BAA0B;IAC1C,gCAAgC;IAChC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAEjC;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAEhD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAEpC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;CAC3B;AAID;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,UAAS,0BAA+B,KACtC,iBA6FF,CAAC"}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@fuzdev/mdz",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "a strict markdown dialect built for streaming, Svelte authoring, docs websites, and untrusted content",
   "tagline": "markdown for fuz",
   "glyph": "📝",
   "logo": "logo.svg",
   "logo_alt": "a friendly pixelated spider facing you",
-  "license": "MIT",
+  "license": "0BSD",
   "homepage": "https://mdz.fuz.dev/",
   "author": {
     "name": "Ryan Atkinson",
@@ -64,12 +64,12 @@
   },
   "devDependencies": {
     "@fuzdev/blake3-wasm": "^0.2.0",
-    "@fuzdev/fuz_code": "^0.50.0",
+    "@fuzdev/fuz_code": "^0.52.1",
     "@fuzdev/fuz_css": "^0.66.1",
-    "@fuzdev/fuz_ui": "^0.212.0",
+    "@fuzdev/fuz_ui": "^0.213.0",
     "@fuzdev/fuz_util": "^0.72.0",
-    "@fuzdev/gro": "^0.214.0",
-    "@ryanatkn/eslint-config": "^0.12.2",
+    "@fuzdev/gro": "^0.216.0",
+    "@ryanatkn/eslint-config": "^0.13.0",
     "@sveltejs/acorn-typescript": "^1.0.10",
     "@sveltejs/adapter-static": "^4.0.0",
     "@sveltejs/kit": "^3.0.1",
@@ -83,7 +83,7 @@
     "esm-env": "^1.2.2",
     "svelte": "^5.57.2",
     "svelte-check": "^4.7.6",
-    "svelte-docinfo": "^0.8.0",
+    "svelte-docinfo": "^0.9.0",
     "svelte2tsx": "^0.7.56",
     "tslib": "^2.8.1",
     "typescript": "^6.0.3",

package/src/lib/mdz.ts

@@ -45,7 +45,7 @@
  * ## Status
  *
  * Pre-stable — breaking changes are expected as the dialect matures.
- * Next: attributes, editing.
+ * Next: editing.
  *
  * @module
  */
@@ -251,10 +251,20 @@ export interface MdzNodeTableCell extends MdzNodeBase {
 	children: Array<MdzNode>;
 }
 
+export interface MdzAttribute {
+	name: string;
+	/** `true` for bare boolean shorthand (`disabled` ≡ `disabled={true}`). */
+	value: string | true;
+	start: number;
+	end: number;
+}
+
 export interface MdzNodeElement extends MdzNodeBase {
 	type: 'Element';
 	/** HTML element name (e.g. `div`, `span`, `aside`). */
 	name: string;
+	/** Parsed tag attributes; always present, possibly empty. */
+	attributes: Array<MdzAttribute>;
 	children: Array<MdzNode>;
 }
 
@@ -262,5 +272,7 @@ export interface MdzNodeComponent extends MdzNodeBase {
 	type: 'Component';
 	/** Svelte component name (e.g. `Alert`, `Card`). */
 	name: string;
+	/** Parsed tag attributes; always present, possibly empty. */
+	attributes: Array<MdzAttribute>;
 	children: Array<MdzNode>;
 }

package/src/lib/mdz_contexts.ts

@@ -2,21 +2,51 @@ import type { Component } from 'svelte';
 
 import { create_context } from './context_helpers.ts';
 
+/**
+ * The attributes a registered component receives as props: a list of allowed
+ * names, or `'all'` to pass every attribute through. Attributes outside the
+ * list are dropped (DEV-warned).
+ */
+export type MdzComponentProps = ReadonlyArray<string> | 'all';
+
+/**
+ * A component registry entry that allows attributes through as props.
+ */
+export interface MdzComponentConfig {
+	component: Component<any, any>;
+	/** Attribute names passed as props, or `'all'`; omitted passes none. */
+	props?: MdzComponentProps;
+}
+
 /**
  * Component registry for custom Svelte components that can be used in mdz content.
  *
- * For example, registering 'Alert' allows using `<Alert>...</Alert>` in mdz content.
+ * A bare component entry renders the tag with no props — its attributes are
+ * dropped. A `MdzComponentConfig` entry names the attributes that pass through
+ * as props, so a component only receives what it's prepared for:
  *
- * The Map values are Svelte components.
+ * ```ts
+ * new Map([
+ * 	['Alert', {component: Alert, props: ['status']}], // `<Alert status="error">`
+ * 	['Note', Note], // `<Note>`, attributes dropped
+ * ]);
+ * ```
+ *
+ * Attribute values are author-controlled strings (or `true` for bare names),
+ * so with untrusted content, allow only props the component treats safely.
+ * `props: 'all'` passes everything — a component that spreads rest props onto
+ * an element then forwards `style`, `href`, and the like.
  */
-export type MdzComponents = Map<string, Component<any, any>>; // TODO support params
+// props pass through untyped (`string | true`); a typed registry is a separate concern
+export type MdzComponents = Map<string, Component<any, any> | MdzComponentConfig>;
 
 /**
  * Element registry for HTML elements that can be used in mdz content.
  *
- * For example, registering 'div' allows using `<div>...</div>` in mdz content.
- *
- * The Map values are boolean placeholders for future configuration options.
+ * Register an element by mapping its name to `true` (e.g. `['aside', true]`),
+ * which allows `<aside>...</aside>` in mdz content. Only `true` enables an
+ * element — the renderers treat any other value (including `false`) as
+ * unregistered, so the tag falls back to literal text.
  */
 export type MdzElements = Map<string, boolean>;
 

package/src/lib/mdz_helpers.ts

@@ -7,13 +7,18 @@
  * @module
  */
 
+import { DEV } from 'esm-env';
+import type { Component } from 'svelte';
+
 import type {
+	MdzAttribute,
 	MdzNode,
 	MdzNodeText,
 	MdzNodeComponent,
 	MdzNodeElement,
 	MdzTableAlign
 } from './mdz.ts';
+import type { MdzComponentConfig, MdzComponentProps } from './mdz_contexts.ts';
 
 // Character codes for performance
 /** @nodocs */
@@ -76,6 +81,8 @@ export const AMPERSAND = 38; // &
 /** @nodocs */
 export const APOSTROPHE = 39; // '
 /** @nodocs */
+export const DOUBLE_QUOTE = 34; // "
+/** @nodocs */
 export const PLUS = 43; // +
 /** @nodocs */
 export const EQUALS = 61; // =
@@ -787,6 +794,93 @@ const VOID_ELEMENTS = new Set([
 // implicitly self-closing at parse time, or rejecting the open/close form
 export const mdz_is_void_element = (name: string): boolean => VOID_ELEMENTS.has(name);
 
+/**
+ * The closed, global set of attribute names allowed on rendered HTML elements.
+ * Every name is inert on any element (no URL, no script, no focus or DOM
+ * clobbering), so element safety is independent of which element names a
+ * consumer registers. Anything outside this set is dropped by
+ * `mdz_filter_element_attributes`.
+ */
+export const ALLOWED_ELEMENT_ATTRIBUTES: ReadonlySet<string> = new Set([
+	'class',
+	'title',
+	'lang',
+	'dir',
+	'role',
+	'aria-label',
+	'aria-hidden',
+	'aria-describedby',
+	'aria-labelledby'
+]);
+
+// filters an element's parsed attributes against the allowlist, returning a
+// name→value object ready to spread onto `<svelte:element {...}>`. Disallowed
+// names are dropped (DEV-warned). Used identically by MdzNodeView,
+// MdzStreamNodeView, and mdz_to_svelte, so precompiled and runtime output match.
+export const mdz_filter_element_attributes = (
+	element_name: string,
+	attributes: Array<MdzAttribute>,
+	allowlist: ReadonlySet<string>
+): Record<string, string | true> => {
+	const filtered: Record<string, string | true> = {};
+	for (const attr of attributes) {
+		if (allowlist.has(attr.name)) {
+			filtered[attr.name] = attr.value;
+		} else if (DEV) {
+			console.warn(
+				`mdz: dropped disallowed attribute \`${attr.name}\` on <${element_name}> — not in the element attribute allowlist`
+			);
+		}
+	}
+	return filtered;
+};
+
+// filters a component's parsed attributes against its registered `props`,
+// returning a name→value props object spread onto `<Component {...props}>`.
+// Omitted `props` passes nothing, `'all'` passes everything; dropped names are
+// DEV-warned. Used identically by MdzNodeView, MdzStreamNodeView, and
+// mdz_to_svelte, so precompiled and runtime output match.
+export const mdz_filter_component_attributes = (
+	component_name: string,
+	attributes: Array<MdzAttribute>,
+	props: MdzComponentProps | undefined
+): Record<string, string | true> => {
+	const filtered: Record<string, string | true> = {};
+	for (const attr of attributes) {
+		if (props === 'all' || props?.includes(attr.name)) {
+			filtered[attr.name] = attr.value;
+		} else if (DEV) {
+			console.warn(
+				`mdz: dropped attribute \`${attr.name}\` on <${component_name}> — not in its registered props`
+			);
+		}
+	}
+	return filtered;
+};
+
+// normalizes a component registry entry to its config form
+export const mdz_component_config = (
+	entry: Component<any, any> | MdzComponentConfig
+): MdzComponentConfig => (typeof entry === 'function' ? { component: entry } : entry);
+
+// reconstructs authored attribute text (` name="value"` / ` name`) for the
+// unregistered-tag literal placeholder. The quote char is chosen so a value
+// containing one quote type stays balanced — a parsed value holds at most one
+// (a `"`-delimited value can't contain `"`, a `'`-delimited one can't contain
+// `'`). The caller interpolates the result as Svelte text (auto-escaped).
+export const mdz_format_unregistered_attributes = (attributes: Array<MdzAttribute>): string => {
+	let text = '';
+	for (const attr of attributes) {
+		if (attr.value === true) {
+			text += ` ${attr.name}`;
+		} else {
+			const quote = attr.value.includes('"') ? "'" : '"';
+			text += ` ${attr.name}=${quote}${attr.value}${quote}`;
+		}
+	}
+	return text;
+};
+
 /**
  * Resolves a relative path (`./` or `../`) against a base path.
  * The base is treated as a directory regardless of trailing slash
@@ -817,6 +911,20 @@ export const mdz_resolve_relative_path = (reference: string, base: string): stri
 	return segments.join('/');
 };
 
+// `/a` → `a`, `//a` → `a` — the pathname form `resolve()` takes; `\` counts as a
+// slash too, and tab/LF/CR are dropped, since browsers read `/\host` and
+// `/<tab>/host` as protocol-relative
+const strip_leading_slashes = (path: string): string => {
+	let i = 0;
+	for (;;) {
+		const c = path.charCodeAt(i);
+		if (c !== SLASH && c !== BACKSLASH && c !== TAB && c !== NEWLINE && c !== CARRIAGE_RETURN)
+			break;
+		i++;
+	}
+	return path.slice(i);
+};
+
 /**
  * How a `Link` node's `reference` should render, shared by all three renderers
  * (`MdzNodeView`, `MdzStreamNodeView`, `mdz_to_svelte`) so the safety gate and
@@ -826,8 +934,13 @@ export const mdz_resolve_relative_path = (reference: string, base: string): stri
 export type MdzLinkRender =
 	/** Unsafe protocol — render children only, no `<a>`. */
 	| { kind: 'unsafe' }
-	/** Route/relative path — wrap in `resolve()` (needs `$app/paths`). */
-	| { kind: 'resolve'; href: string }
+	/**
+	 * Absolute path — render `resolve(path)` (needs `$app/paths`). `path` is the
+	 * reference minus its leading slash, SvelteKit's pathname form, which only
+	 * prepends the base path (or `#` under hash routing; a relative `./`/`../`
+	 * prefix under `paths.relative` SSR) and keeps the rest verbatim.
+	 */
+	| { kind: 'resolve'; path: string }
 	/** Internal fragment/query/relative/bare ref — raw `href`, no `resolve()`. */
 	| { kind: 'internal'; href: string }
 	/** External link — raw `href` plus `target="_blank" rel="noopener"`. */
@@ -836,6 +949,13 @@ export type MdzLinkRender =
 /**
  * Classify a `Link` reference into how it should render. Pure — no rendering,
  * no context; `base` is the resolved base path (or `undefined`).
+ *
+ * Absolute references are authored URLs, not SvelteKit route ids: they classify
+ * as `resolve` with the base-relative pathname, never a leading-slash route id,
+ * whose resolution would drop `(group)` and empty segments, decode `[x+nn]`
+ * escapes, and throw on `[param]` segments. A leading `/` followed by any `/`
+ * or `\` run collapses to one `/`, so `//host` and `/\host` stay under the base
+ * rather than becoming protocol-relative.
  * @nodocs
  */
 export const mdz_classify_link = (
@@ -846,19 +966,14 @@ export const mdz_classify_link = (
 	if (!mdz_is_safe_reference(reference)) return { kind: 'unsafe' };
 	if (link_type === 'internal') {
 		if (reference.startsWith('.') && base) {
-			return { kind: 'resolve', href: mdz_resolve_relative_path(reference, base) };
-		}
-		// fragment/query/relative/bare — `resolve()` only accepts absolute paths or
-		// route ids and throws on anything else
-		if (
-			reference.startsWith('#') ||
-			reference.startsWith('?') ||
-			reference.startsWith('.') ||
-			!reference.startsWith('/')
-		) {
-			return { kind: 'internal', href: reference };
+			return {
+				kind: 'resolve',
+				path: strip_leading_slashes(mdz_resolve_relative_path(reference, base))
+			};
 		}
-		return { kind: 'resolve', href: reference };
+		// fragment/query/relative/bare — not under the base, so a raw `href`
+		if (!reference.startsWith('/')) return { kind: 'internal', href: reference };
+		return { kind: 'resolve', path: strip_leading_slashes(reference) };
 	}
 	return { kind: 'external', href: reference };
 };

package/src/lib/mdz_lexer.ts

@@ -26,6 +26,9 @@ import {
 	LEFT_ANGLE,
 	RIGHT_ANGLE,
 	SLASH,
+	EQUALS,
+	APOSTROPHE,
+	DOUBLE_QUOTE,
 	PERIOD,
 	LEFT_BRACKET,
 	LEFT_PAREN,
@@ -58,7 +61,7 @@ import {
 	TEXT_SCAN_CLASS
 } from './mdz_helpers.ts';
 
-import type { MdzTableAlign } from './mdz.ts';
+import type { MdzAttribute, MdzTableAlign } from './mdz.ts';
 import { mdz_debug_work } from './mdz_debug_work.ts';
 
 //
@@ -177,12 +180,14 @@ export interface MdzTokenTagOpen extends MdzTokenBase {
 	type: 'tag_open';
 	name: string;
 	is_component: boolean;
+	attributes: Array<MdzAttribute>;
 }
 
 export interface MdzTokenTagSelfClose extends MdzTokenBase {
 	type: 'tag_self_close';
 	name: string;
 	is_component: boolean;
+	attributes: Array<MdzAttribute>;
 }
 
 export interface MdzTokenTagClose extends MdzTokenBase {
@@ -1794,9 +1799,78 @@ export class MdzLexer {
 		const first_char_code = tag_name.charCodeAt(0);
 		const is_component = first_char_code >= A_UPPER && first_char_code <= Z_UPPER;
 
-		// Skip whitespace
-		while (this.#index < this.#text.length && this.#text.charCodeAt(this.#index) === SPACE) {
-			this.#index++;
+		// Attribute loop: consume space-separated attributes until `/>` or `>`.
+		// Registry-blind — every syntactically valid attribute is parsed here;
+		// policy (allowlist filtering) happens at render/build time. The scan is
+		// a single forward pass bounded by the line: any newline (or a missing
+		// separator, bad value, or duplicate name) rejects the whole tag to
+		// literal text via the shared `#reject_tag` bailout.
+		const attributes: Array<MdzAttribute> = [];
+		const seen = new Set<string>(); // O(1) duplicate-name detection
+		for (;;) {
+			// skip a run of literal spaces only (tabs/newlines are not SPACE, so
+			// they fall through to the reject path — the single-line, space-only rule)
+			let had_space = false;
+			while (this.#index < this.#text.length && this.#text.charCodeAt(this.#index) === SPACE) {
+				this.#index++;
+				had_space = true;
+			}
+			const c = this.#index < this.#text.length ? this.#text.charCodeAt(this.#index) : -1;
+			// `/>` or `>` ends the open tag — break to the existing self-close / commit
+			if (c === SLASH || c === RIGHT_ANGLE) break;
+			// otherwise an attribute name must follow, space-separated from what
+			// precedes it (`<a x="1"y="2">` rejects — `y` abuts the closing quote)
+			if (c === -1 || !had_space || !is_letter(c)) {
+				this.#reject_tag(start, bound);
+				return;
+			}
+			// collect the attribute name (same grammar as tag names)
+			const attr_start = this.#index;
+			this.#index++; // first char already passed is_letter
+			while (
+				this.#index < this.#text.length &&
+				is_tag_name_char(this.#text.charCodeAt(this.#index))
+			) {
+				this.#index++;
+			}
+			const name = this.#text.slice(attr_start, this.#index);
+			// duplicate names are ambiguous (Svelte compile-errors) → literal tag
+			if (seen.has(name)) {
+				this.#reject_tag(start, bound);
+				return;
+			}
+			seen.add(name);
+			let value: string | true = true; // bare name is boolean `true`
+			if (this.#index < this.#text.length && this.#text.charCodeAt(this.#index) === EQUALS) {
+				this.#index++; // consume =
+				// the value must be immediately quoted — no space after `=`, no
+				// `{` brace literal, no unquoted value (this one check covers all)
+				const quote = this.#index < this.#text.length ? this.#text.charCodeAt(this.#index) : -1;
+				if (quote !== DOUBLE_QUOTE && quote !== APOSTROPHE) {
+					this.#reject_tag(start, bound);
+					return;
+				}
+				this.#index++; // consume opening quote
+				const value_start = this.#index;
+				// scan to the matching quote, bounded by newline / text end — NOT
+				// by `#max_search_index` (the open-tag scan never is); a `>` inside
+				// the value is content, consumed atomically before `>` is sought
+				while (
+					this.#index < this.#text.length &&
+					this.#text.charCodeAt(this.#index) !== quote &&
+					this.#text.charCodeAt(this.#index) !== NEWLINE
+				) {
+					this.#index++;
+				}
+				if (this.#index >= this.#text.length || this.#text.charCodeAt(this.#index) === NEWLINE) {
+					// unterminated quote (or newline inside the value) → literal tag
+					this.#reject_tag(start, bound);
+					return;
+				}
+				value = this.#text.slice(value_start, this.#index);
+				this.#index++; // consume closing quote
+			}
+			attributes.push({ name, value, start: attr_start, end: this.#index });
 		}
 
 		// Check for self-closing />
@@ -1810,6 +1884,7 @@ export class MdzLexer {
 				type: 'tag_self_close',
 				name: tag_name,
 				is_component,
+				attributes,
 				start,
 				end: this.#index
 			});
@@ -1818,9 +1893,7 @@ export class MdzLexer {
 
 		// Check for >
 		if (this.#index >= this.#text.length || this.#text.charCodeAt(this.#index) !== RIGHT_ANGLE) {
-			this.#failed_tag.add(`${start}:${bound}`);
-			this.#index = start + 1;
-			this.#emit_text('<', start);
+			this.#reject_tag(start, bound);
 			return;
 		}
 		this.#index++; // consume >
@@ -1837,21 +1910,24 @@ export class MdzLexer {
 		const search_limit = Math.min(this.#max_search_index, this.#text.length);
 		const closing_tag_pos = this.#index_of(closing_tag, this.#index);
 		if (closing_tag_pos === -1 || closing_tag_pos > search_limit) {
-			this.#failed_tag.add(`${start}:${bound}`);
-			this.#index = start + 1;
-			this.#emit_text('<', start);
+			this.#reject_tag(start, bound);
 			return;
 		}
 		if (this.#has_paragraph_break_between(this.#index, closing_tag_pos)) {
-			this.#failed_tag.add(`${start}:${bound}`);
-			this.#index = start + 1;
-			this.#emit_text('<', start);
+			this.#reject_tag(start, bound);
 			return;
 		}
 
 		// Emit tag_open
 		const open_token_index = this.#tokens.length;
-		this.#tokens.push({ type: 'tag_open', name: tag_name, is_component, start, end: this.#index });
+		this.#tokens.push({
+			type: 'tag_open',
+			name: tag_name,
+			is_component,
+			attributes,
+			start,
+			end: this.#index
+		});
 
 		// Tokenize children until the closing tag. Each iteration narrows
 		// `#max_search_index` to the next closer so a child's delimiter scan
@@ -1892,8 +1968,15 @@ export class MdzLexer {
 		// (the `#revert_tokens_from_link_open` pattern; the old fallthrough
 		// left a dangling `tag_open` whose parser fallback discarded content)
 		this.#max_search_index = saved_max;
-		this.#failed_tag.add(`${start}:${bound}`);
 		this.#tokens.splice(open_token_index);
+		this.#reject_tag(start, bound);
+	}
+
+	// a tag open at `start` that can't commit: memoizes the failure for this
+	// `bound` so re-entries bail fast, then emits the `<` as text and resumes
+	// scanning after it — the rest re-parses as ordinary content
+	#reject_tag(start: number, bound: number): void {
+		this.#failed_tag.add(`${start}:${bound}`);
 		this.#index = start + 1;
 		this.#emit_text('<', start);
 	}