@mulmoclaude/markdown-utils 1.3.1 → 1.3.3

package/dist/dom/externalLink.js

@@ -8,6 +8,14 @@
 // invoke the wrapper from their own `@click` handler and check the
 // return value to decide whether to fall through to plugin-specific
 // navigation.
+// `nodeType`, not `instanceof Element`: this package is also consumed outside a
+// browser (the Node + jsdom test harness installs `window`/`document` but not
+// the DOM constructors), where the bare `Element` global is a ReferenceError.
+// nodeType 1 is the DOM standard's own element discriminant, and it stops at
+// Element rather than HTMLElement because an inline <svg> inside a link is a
+// legitimate click target that must still resolve to its anchor.
+const ELEMENT_NODE = 1;
+const isElementNode = (target) => target !== null && "nodeType" in target && target.nodeType === ELEMENT_NODE;
 // Pure predicate: is `href` an absolute http(s) URL pointing at an
 // origin different from `currentOrigin`? Used by
 // `handleExternalLinkClick` below, and directly by tests.
@@ -42,8 +50,8 @@ export function handleExternalLinkClick(event) {
         return false;
     if (event.ctrlKey || event.metaKey || event.shiftKey)
         return false;
-    const target = event.target;
-    if (!target)
+    const { target } = event;
+    if (!isElementNode(target))
         return false;
     const anchor = target.closest("a");
     if (!anchor)

package/dist/image/htmlSrcAttrs.js

@@ -141,10 +141,24 @@ const RESOLVABLE_TAG_OUTER_RE = /<(?:img|source|video|audio)\b(?:[^>"']|"[^"]*"|
 // look like a tag.
 const TAG_NAME_RE = /^<([a-z]+)/i;
 // Attribute iterator: walks each `name=value` pair inside a tag. The
-// leading `\s+` ensures we only match real attribute boundaries, not
+// leading `\s` ensures we only match real attribute boundaries, not
 // `src=` text embedded inside another attribute's quoted value.
+//
+// That leading class is a single `\s`, NOT `\s+`, and the difference is
+// quadratic runtime rather than style. With `\s+`, a run of N spaces that
+// is not followed by an attribute name makes the engine match all N, fail
+// `[A-Za-z]`, then backtrack through every shorter length — repeated from
+// every start position inside the run, so `<img` + N spaces + `!>` costs
+// O(N²) (measured 4x per doubling; ~1.7s at N=32k). Matching one
+// whitespace char cannot backtrack, so the same input is linear.
+//
+// Output is unaffected: under the `g` flag the scan advances one char at a
+// time, so the match still lands on the whitespace immediately before the
+// name. Any earlier whitespace simply falls outside the match and is
+// copied through verbatim by `replace`.
+//
 // Capture groups:
-//   1: leading whitespace
+//   1: the single whitespace char before the attribute name
 //   2: attribute name
 //   3: `=` with surrounding spaces (only when value present)
 //   4: full quoted/unquoted value (unused but captured for clarity)
@@ -155,8 +169,8 @@ const TAG_NAME_RE = /^<([a-z]+)/i;
 //      quote as the value
 //
 // All quantifiers bounded — verified ReDoS-safe in test_htmlSrcAttrs.ts.
-// eslint-disable-next-line sonarjs/super-linear-regex, sonarjs/regex-complexity, security/detect-unsafe-regex -- bounded quantifiers, ReDoS-safe (test in test_htmlSrcAttrs.ts)
-const ATTR_ITER_RE = /(\s+)([A-Za-z][\w:-]*)(?:(\s*=\s*)("([^"]*)"|'([^']*)'|([^\s>"'][^\s>]*)))?/g;
+// eslint-disable-next-line sonarjs/regex-complexity, security/detect-unsafe-regex -- bounded quantifiers, ReDoS-safe (test in test_htmlSrcAttrs.ts)
+const ATTR_ITER_RE = /(\s)([A-Za-z][\w:-]*)(?:(\s*=\s*)("([^"]*)"|'([^']*)'|([^\s>"'][^\s>]*)))?/g;
 /** Transform every URL-bearing attribute on a recognised tag.
  *
  *  `transform` is invoked once per matching attribute value. Return:
@@ -189,8 +203,17 @@ export function transformResolvableUrlsInHtml(html, transform) {
         return tag.replace(ATTR_ITER_RE, (...captures) => replaceAttrIfResolvable(captures, resolvableAttrs ?? [], srcsetAttrs ?? [], transform));
     });
 }
+// Named view of `ATTR_ITER_RE`'s capture list (group 4, the full quoted
+// value, is captured for clarity and skipped here). Groups that never
+// participate come back `undefined`; the three the regex always fills fall
+// back to `""` so a non-string can only ever blank the attribute, never
+// reach the rewriter as if it were text.
+function readAttrCaptures(captures) {
+    const [full, leading, name, eqWithSpaces, , doubleQuoted, singleQuoted, bare] = captures.map((value) => (typeof value === "string" ? value : undefined));
+    return { full: full ?? "", leading: leading ?? "", name: name ?? "", eqWithSpaces, doubleQuoted, singleQuoted, bare };
+}
 function replaceAttrIfResolvable(captures, resolvableAttrs, srcsetAttrs, transform) {
-    const [full, leading, name, eqWithSpaces, , doubleQuoted, singleQuoted, bare] = captures;
+    const { full, leading, name, eqWithSpaces, doubleQuoted, singleQuoted, bare } = readAttrCaptures(captures);
     if (!eqWithSpaces)
         return full;
     const lowerName = name.toLowerCase();

package/dist/image/rewriteMarkdownImageRefs.js

@@ -89,6 +89,9 @@ function extractBracketedAlt(raw) {
     }
     return null;
 }
+// Declares the four fields it reads rather than the whole `Tokens.Image`:
+// `type === "image"` leaves marked's open `Tokens.Generic` member in the
+// union, and every read below already tolerates a missing value.
 function rewriteImageToken(token, basePath) {
     const href = (token.href ?? "").trim();
     if (href === "" || shouldSkip(href))
@@ -147,15 +150,24 @@ export function rewriteImgSrcAttrsInHtml(html, basePath) {
 function isSkippable(token) {
     return token.type === "code" || token.type === "codespan";
 }
+// `Tokens.Generic` — the open member of marked's `Token` union — requires
+// only a string `type` and a string `raw`, so proving those two is enough
+// to call a value a `Token`.
+function isToken(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    return "type" in value && typeof value.type === "string" && "raw" in value && typeof value.raw === "string";
+}
+function toTokenArray(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return null;
+    const candidates = value;
+    return candidates.every(isToken) ? candidates : null;
+}
 function getContainerChildren(token) {
-    const container = token;
-    if (Array.isArray(container.tokens) && container.tokens.length > 0) {
-        return container.tokens;
-    }
-    if (Array.isArray(container.items) && container.items.length > 0) {
-        return container.items;
-    }
-    return null;
+    const tokens = "tokens" in token ? token.tokens : undefined;
+    const items = "items" in token ? token.items : undefined;
+    return toTokenArray(tokens) ?? toTokenArray(items);
 }
 // Render a container's children back into the output, preserving any
 // structural glue the parent carries outside the children's combined
@@ -163,7 +175,7 @@ function getContainerChildren(token) {
 // Returns true if the container was rendered via its children, false
 // if the caller should fall back to emitting the parent's raw.
 function renderContainerChildren(raw, children, basePath, out) {
-    const joined = children.map((token) => token.raw ?? "").join("");
+    const joined = children.map((token) => token.raw).join("");
     if (joined === "")
         return false;
     const idx = raw.indexOf(joined);
@@ -201,13 +213,11 @@ function renderToken(token, basePath, out) {
         // Block / inline HTML — rewrite raw <img> tags inside before
         // emitting. Markdown image syntax (![alt](url)) is handled by the
         // image-token branch above; this branch covers the HTML-fallback
-        // path (#1011 Stage A). Fall back to verbatim raw if `raw` is
-        // unexpectedly missing — defensive against future marked changes.
-        const raw = token.raw ?? "";
-        out.push(rewriteImgSrcAttrsInHtml(raw, basePath));
+        // path (#1011 Stage A).
+        out.push(rewriteImgSrcAttrsInHtml(token.raw, basePath));
         return;
     }
-    const raw = token.raw ?? "";
+    const { raw } = token;
     const children = getContainerChildren(token);
     if (children && renderContainerChildren(raw, children, basePath, out)) {
         return;

package/dist/markdown/frontmatter.js

@@ -10,6 +10,7 @@
 // lists, multi-line strings, escaping) instead of the regex
 // approximation in the legacy `src/utils/format/frontmatter.ts`.
 import { FAILSAFE_SCHEMA, dump as yamlDump, load as yamlLoad } from "js-yaml";
+import { isRecord } from "@mulmoclaude/common";
 const FRONTMATTER_OPEN = /^---\r?\n/;
 // `(?:^|\r?\n)` lets the closing fence sit at the very start of
 // `afterOpen` — needed for the empty-envelope case `---\n---\n`
@@ -116,7 +117,7 @@ function safeYamlLoad(text) {
         // plain objects — anything else is a malformed header.
         if (loaded === null || loaded === undefined)
             return {};
-        if (typeof loaded !== "object" || Array.isArray(loaded))
+        if (!isRecord(loaded))
             return null;
         return loaded;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mulmoclaude/markdown-utils",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Browser-safe markdown / image rendering utilities shared by the MulmoClaude host and the markdown plugin",
   "type": "module",
   "main": "./dist/index.js",