agent-sanitizer 2.53.0 → 2.54.0

package/LICENSE-THIRD-PARTY

@@ -0,0 +1,28 @@
+Third-party code redistributed in this package.
+
+src/vendor/gfm-autolink-literal.mjs
+  Copied from micromark-extension-gfm-autolink-literal@2.1.0, with one
+  function changed (see that file's header). Original licence follows.
+
+(The MIT License)
+
+Copyright (c) 2020 Titus Wormer <tituswormer@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.53.0",
+  "version": "2.54.0",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {
@@ -65,6 +65,7 @@
     "lint-staged": "^17.0.5",
     "prettier": "^3.0.0",
     "rehype-parse": "9.0.1",
+    "remark-gfm": "4.0.1",
     "smol-toml": "^1.7.1",
     "typescript": "6.0.3",
     "typescript-eslint": "8.61.0",
@@ -204,6 +205,7 @@
   },
   "files": [
     "src/*.mjs",
+    "src/vendor/*.mjs",
     "python/agent_sanitizer/data/invisible-charset.json",
     "python/agent_sanitizer/secrets/data/credential-names.json",
     "python/agent_sanitizer/secrets/data/redaction-floor.json",
@@ -213,6 +215,7 @@
     "bin/sanitize-cli.mjs",
     "types",
     "LICENSE",
+    "LICENSE-THIRD-PARTY",
     "README.md",
     "THREAT-MODEL.md",
     "SECURITY.md"
@@ -221,9 +224,16 @@
     "agent-control-plane-core": "0.3.0",
     "css-tree": "^3.2.1",
     "hast-util-from-parse5": "8.0.3",
+    "mdast-util-gfm": "3.1.0",
+    "micromark-extension-gfm-footnote": "2.1.0",
+    "micromark-extension-gfm-strikethrough": "2.1.0",
+    "micromark-extension-gfm-table": "2.1.1",
+    "micromark-extension-gfm-task-list-item": "2.1.0",
+    "micromark-util-character": "2.1.1",
+    "micromark-util-combine-extensions": "2.0.1",
+    "micromark-util-types": "2.0.2",
     "namespace-guard": "0.20.0",
     "parse5": "7.3.0",
-    "remark-gfm": "4.0.1",
     "remark-parse": "11.0.0",
     "unified": "11.0.5",
     "unist-util-visit": "5.1.0",

package/src/gfm.mjs

@@ -0,0 +1,54 @@
+/**
+ * `remark-gfm` with one extension swapped for a corrected copy.
+ *
+ * This is `remark-gfm@4.0.1`'s own plugin body and
+ * `micromark-extension-gfm@3.0.0`'s own `gfm()` composition, inlined so that
+ * `gfmAutolinkLiteral` can come from `./vendor/gfm-autolink-literal.mjs`
+ * instead of the published package — see that file for what differs and when
+ * to delete both. Every other extension, and the mdast layer, are the upstream
+ * ones at the versions `remark-gfm` pins.
+ *
+ * Assembling the list here rather than adding an extension beside `remark-gfm`
+ * is deliberate: micromark tries the constructs registered for a character in
+ * order, so a second autolink extension would run AFTER the upstream one and
+ * change nothing.
+ *
+ * `test/gfm-autolink-parity.test.mjs` pins this against upstream's answers.
+ */
+import { gfmFromMarkdown, gfmToMarkdown } from "mdast-util-gfm";
+import { gfmFootnote } from "micromark-extension-gfm-footnote";
+import { gfmStrikethrough } from "micromark-extension-gfm-strikethrough";
+import { gfmTable } from "micromark-extension-gfm-table";
+import { gfmTaskListItem } from "micromark-extension-gfm-task-list-item";
+import { combineExtensions } from "micromark-util-combine-extensions";
+
+import { gfmAutolinkLiteral } from "./vendor/gfm-autolink-literal.mjs";
+
+/**
+ * A unified plugin adding GFM support: autolink literals, footnotes,
+ * strikethrough, tables and task lists — the same set, in the same order, as
+ * `remark-gfm`.
+ * @this {any} unified processor
+ * @returns {undefined}
+ */
+export default function remarkGfmFixed() {
+  const data = this.data();
+  const micromarkExtensions =
+    data.micromarkExtensions || (data.micromarkExtensions = []);
+  const fromMarkdownExtensions =
+    data.fromMarkdownExtensions || (data.fromMarkdownExtensions = []);
+  const toMarkdownExtensions =
+    data.toMarkdownExtensions || (data.toMarkdownExtensions = []);
+
+  micromarkExtensions.push(
+    combineExtensions([
+      gfmAutolinkLiteral(),
+      gfmFootnote(),
+      gfmStrikethrough(),
+      gfmTable(),
+      gfmTaskListItem(),
+    ]),
+  );
+  fromMarkdownExtensions.push(gfmFromMarkdown());
+  toMarkdownExtensions.push(gfmToMarkdown());
+}

package/src/html.mjs

@@ -48,7 +48,7 @@ import cssGenerate from "css-tree/generator";
 import { ident as cssIdent } from "css-tree/utils";
 import { unified } from "unified";
 import remarkParse from "remark-parse";
-import remarkGfm from "remark-gfm";
+import remarkGfm from "./gfm.mjs";
 import { parseHtmlFragment } from "./html-tree-adapter.mjs";
 import { SKIP, EXIT } from "unist-util-visit";
 import {

package/src/vendor/gfm-autolink-literal.mjs

@@ -0,0 +1,1015 @@
+/**
+ * GFM autolink literals for micromark, vendored from
+ * `micromark-extension-gfm-autolink-literal@2.1.0` (MIT, (c) 2020 Titus
+ * Wormer). The licence is in `LICENSE-THIRD-PARTY` at the repository root.
+ *
+ * WHY A COPY. `previousUnbalanced` below decides whether an autolink literal
+ * may start at this position, and upstream answers it by walking back over
+ * every event the document has produced so far. It memoizes only the "no"
+ * answer, so one unclosed `[` — a JSON array is the everyday shape, since its
+ * `]` is the last byte — makes the answer "yes" for the rest of the document
+ * and costs one full walk per word character. 172 KB of prose behind a single
+ * `[` took 20.2s to parse; the same text takes 0.17s here. Layer 3 reads its
+ * URLs off this parse, so the cost lands on every `detectExfil` call.
+ *
+ * WHAT CHANGED. One function. `previousUnbalanced` now also records where the
+ * walk stopped, and a later walk resumes from that index rather than re-reading
+ * the run before it. The record is used only while `events[index]` still holds
+ * the same token, so a resolver that splices events invalidates it and the walk
+ * falls back to reading everything. Nothing else in this file differs from
+ * upstream — diff it against the published package to confirm.
+ *
+ * WHY NOT A PATCH. A `pnpm` patch fixes this repository's own installs and the
+ * plugin bundle built from them, and reaches no consumer of the published npm
+ * package (see the npm-consumer gap in the project history). A copy under
+ * `src/` ships.
+ *
+ * WHEN TO DELETE IT. When a published release of the upstream package carries
+ * an equivalent fix: drop this file and the assembly in `./gfm.mjs`, and go
+ * back to `remark-gfm`. `test/gfm-autolink-parity.test.mjs` pins the behaviour
+ * either way.
+ */
+
+/**
+ * @import {Code, ConstructRecord, Event, Extension, Previous, State, TokenizeContext, Tokenizer} from 'micromark-util-types'
+ */
+
+import {
+  asciiAlpha,
+  asciiAlphanumeric,
+  asciiControl,
+  markdownLineEndingOrSpace,
+  unicodePunctuation,
+  unicodeWhitespace,
+} from "micromark-util-character";
+const wwwPrefix = {
+  tokenize: tokenizeWwwPrefix,
+  partial: true,
+};
+const domain = {
+  tokenize: tokenizeDomain,
+  partial: true,
+};
+const path = {
+  tokenize: tokenizePath,
+  partial: true,
+};
+const trail = {
+  tokenize: tokenizeTrail,
+  partial: true,
+};
+const emailDomainDotTrail = {
+  tokenize: tokenizeEmailDomainDotTrail,
+  partial: true,
+};
+const wwwAutolink = {
+  name: "wwwAutolink",
+  tokenize: tokenizeWwwAutolink,
+  previous: previousWww,
+};
+const protocolAutolink = {
+  name: "protocolAutolink",
+  tokenize: tokenizeProtocolAutolink,
+  previous: previousProtocol,
+};
+const emailAutolink = {
+  name: "emailAutolink",
+  tokenize: tokenizeEmailAutolink,
+  previous: previousEmail,
+};
+
+/** @type {ConstructRecord} */
+const text = {};
+
+/**
+ * Create an extension for `micromark` to support GitHub autolink literal
+ * syntax.
+ *
+ * @returns {Extension}
+ *   Extension for `micromark` that can be passed in `extensions` to enable GFM
+ *   autolink literal syntax.
+ */
+export function gfmAutolinkLiteral() {
+  return {
+    text,
+  };
+}
+
+/** @type {Code} */
+let code = 48;
+
+// Add alphanumerics.
+while (code < 123) {
+  text[code] = emailAutolink;
+  code++;
+  if (code === 58) code = 65;
+  else if (code === 91) code = 97;
+}
+text[43] = emailAutolink;
+text[45] = emailAutolink;
+text[46] = emailAutolink;
+text[95] = emailAutolink;
+text[72] = [emailAutolink, protocolAutolink];
+text[104] = [emailAutolink, protocolAutolink];
+text[87] = [emailAutolink, wwwAutolink];
+text[119] = [emailAutolink, wwwAutolink];
+
+// To do: perform email autolink literals on events, afterwards.
+// That’s where `markdown-rs` and `cmark-gfm` perform it.
+// It should look for `@`, then for atext backwards, and then for a label
+// forwards.
+// To do: `mailto:`, `xmpp:` protocol as prefix.
+
+/**
+ * Email autolink literal.
+ *
+ * ```markdown
+ * > | a contact@example.org b
+ *       ^^^^^^^^^^^^^^^^^^^
+ * ```
+ *
+ * @this {TokenizeContext}
+ * @type {Tokenizer}
+ */
+function tokenizeEmailAutolink(effects, ok, nok) {
+  const self = this;
+  /** @type {boolean | undefined} */
+  let dot;
+  /** @type {boolean} */
+  let data;
+  return start;
+
+  /**
+   * Start of email autolink literal.
+   *
+   * ```markdown
+   * > | a contact@example.org b
+   *       ^
+   * ```
+   *
+   * @type {State}
+   */
+  function start(code) {
+    if (
+      !gfmAtext(code) ||
+      !previousEmail.call(self, self.previous) ||
+      previousUnbalanced(self.events)
+    ) {
+      return nok(code);
+    }
+    effects.enter("literalAutolink");
+    effects.enter("literalAutolinkEmail");
+    return atext(code);
+  }
+
+  /**
+   * In email atext.
+   *
+   * ```markdown
+   * > | a contact@example.org b
+   *       ^
+   * ```
+   *
+   * @type {State}
+   */
+  function atext(code) {
+    if (gfmAtext(code)) {
+      effects.consume(code);
+      return atext;
+    }
+    if (code === 64) {
+      effects.consume(code);
+      return emailDomain;
+    }
+    return nok(code);
+  }
+
+  /**
+   * In email domain.
+   *
+   * The reference code is a bit overly complex as it handles the `@`, of which
+   * there may be just one.
+   * Source: <https://github.com/github/cmark-gfm/blob/ef1cfcb/extensions/autolink.c#L318>
+   *
+   * ```markdown
+   * > | a contact@example.org b
+   *               ^
+   * ```
+   *
+   * @type {State}
+   */
+  function emailDomain(code) {
+    // Dot followed by alphanumerical (not `-` or `_`).
+    if (code === 46) {
+      return effects.check(
+        emailDomainDotTrail,
+        emailDomainAfter,
+        emailDomainDot,
+      )(code);
+    }
+
+    // Alphanumerical, `-`, and `_`.
+    if (code === 45 || code === 95 || asciiAlphanumeric(code)) {
+      data = true;
+      effects.consume(code);
+      return emailDomain;
+    }
+
+    // To do: `/` if xmpp.
+
+    // Note: normally we’d truncate trailing punctuation from the link.
+    // However, email autolink literals cannot contain any of those markers,
+    // except for `.`, but that can only occur if it isn’t trailing.
+    // So we can ignore truncating!
+    return emailDomainAfter(code);
+  }
+
+  /**
+   * In email domain, on dot that is not a trail.
+   *
+   * ```markdown
+   * > | a contact@example.org b
+   *                      ^
+   * ```
+   *
+   * @type {State}
+   */
+  function emailDomainDot(code) {
+    effects.consume(code);
+    dot = true;
+    return emailDomain;
+  }
+
+  /**
+   * After email domain.
+   *
+   * ```markdown
+   * > | a contact@example.org b
+   *                          ^
+   * ```
+   *
+   * @type {State}
+   */
+  function emailDomainAfter(code) {
+    // Domain must not be empty, must include a dot, and must end in alphabetical.
+    // Source: <https://github.com/github/cmark-gfm/blob/ef1cfcb/extensions/autolink.c#L332>.
+    if (data && dot && asciiAlpha(self.previous)) {
+      effects.exit("literalAutolinkEmail");
+      effects.exit("literalAutolink");
+      return ok(code);
+    }
+    return nok(code);
+  }
+}
+
+/**
+ * `www` autolink literal.
+ *
+ * ```markdown
+ * > | a www.example.org b
+ *       ^^^^^^^^^^^^^^^
+ * ```
+ *
+ * @this {TokenizeContext}
+ * @type {Tokenizer}
+ */
+function tokenizeWwwAutolink(effects, ok, nok) {
+  const self = this;
+  return wwwStart;
+
+  /**
+   * Start of www autolink literal.
+   *
+   * ```markdown
+   * > | www.example.com/a?b#c
+   *     ^
+   * ```
+   *
+   * @type {State}
+   */
+  function wwwStart(code) {
+    if (
+      (code !== 87 && code !== 119) ||
+      !previousWww.call(self, self.previous) ||
+      previousUnbalanced(self.events)
+    ) {
+      return nok(code);
+    }
+    effects.enter("literalAutolink");
+    effects.enter("literalAutolinkWww");
+    // Note: we *check*, so we can discard the `www.` we parsed.
+    // If it worked, we consider it as a part of the domain.
+    return effects.check(
+      wwwPrefix,
+      effects.attempt(domain, effects.attempt(path, wwwAfter), nok),
+      nok,
+    )(code);
+  }
+
+  /**
+   * After a www autolink literal.
+   *
+   * ```markdown
+   * > | www.example.com/a?b#c
+   *                          ^
+   * ```
+   *
+   * @type {State}
+   */
+  function wwwAfter(code) {
+    effects.exit("literalAutolinkWww");
+    effects.exit("literalAutolink");
+    return ok(code);
+  }
+}
+
+/**
+ * Protocol autolink literal.
+ *
+ * ```markdown
+ * > | a https://example.org b
+ *       ^^^^^^^^^^^^^^^^^^^
+ * ```
+ *
+ * @this {TokenizeContext}
+ * @type {Tokenizer}
+ */
+function tokenizeProtocolAutolink(effects, ok, nok) {
+  const self = this;
+  let buffer = "";
+  let seen = false;
+  return protocolStart;
+
+  /**
+   * Start of protocol autolink literal.
+   *
+   * ```markdown
+   * > | https://example.com/a?b#c
+   *     ^
+   * ```
+   *
+   * @type {State}
+   */
+  function protocolStart(code) {
+    if (
+      (code === 72 || code === 104) &&
+      previousProtocol.call(self, self.previous) &&
+      !previousUnbalanced(self.events)
+    ) {
+      effects.enter("literalAutolink");
+      effects.enter("literalAutolinkHttp");
+      buffer += String.fromCodePoint(code);
+      effects.consume(code);
+      return protocolPrefixInside;
+    }
+    return nok(code);
+  }
+
+  /**
+   * In protocol.
+   *
+   * ```markdown
+   * > | https://example.com/a?b#c
+   *     ^^^^^
+   * ```
+   *
+   * @type {State}
+   */
+  function protocolPrefixInside(code) {
+    // `5` is size of `https`
+    if (asciiAlpha(code) && buffer.length < 5) {
+      // @ts-expect-error: definitely number.
+      buffer += String.fromCodePoint(code);
+      effects.consume(code);
+      return protocolPrefixInside;
+    }
+    if (code === 58) {
+      const protocol = buffer.toLowerCase();
+      if (protocol === "http" || protocol === "https") {
+        effects.consume(code);
+        return protocolSlashesInside;
+      }
+    }
+    return nok(code);
+  }
+
+  /**
+   * In slashes.
+   *
+   * ```markdown
+   * > | https://example.com/a?b#c
+   *           ^^
+   * ```
+   *
+   * @type {State}
+   */
+  function protocolSlashesInside(code) {
+    if (code === 47) {
+      effects.consume(code);
+      if (seen) {
+        return afterProtocol;
+      }
+      seen = true;
+      return protocolSlashesInside;
+    }
+    return nok(code);
+  }
+
+  /**
+   * After protocol, before domain.
+   *
+   * ```markdown
+   * > | https://example.com/a?b#c
+   *             ^
+   * ```
+   *
+   * @type {State}
+   */
+  function afterProtocol(code) {
+    // To do: this is different from `markdown-rs`:
+    // https://github.com/wooorm/markdown-rs/blob/b3a921c761309ae00a51fe348d8a43adbc54b518/src/construct/gfm_autolink_literal.rs#L172-L182
+    return code === null ||
+      asciiControl(code) ||
+      markdownLineEndingOrSpace(code) ||
+      unicodeWhitespace(code) ||
+      unicodePunctuation(code)
+      ? nok(code)
+      : effects.attempt(
+          domain,
+          effects.attempt(path, protocolAfter),
+          nok,
+        )(code);
+  }
+
+  /**
+   * After a protocol autolink literal.
+   *
+   * ```markdown
+   * > | https://example.com/a?b#c
+   *                              ^
+   * ```
+   *
+   * @type {State}
+   */
+  function protocolAfter(code) {
+    effects.exit("literalAutolinkHttp");
+    effects.exit("literalAutolink");
+    return ok(code);
+  }
+}
+
+/**
+ * `www` prefix.
+ *
+ * ```markdown
+ * > | a www.example.org b
+ *       ^^^^
+ * ```
+ *
+ * @this {TokenizeContext}
+ * @type {Tokenizer}
+ */
+function tokenizeWwwPrefix(effects, ok, nok) {
+  let size = 0;
+  return wwwPrefixInside;
+
+  /**
+   * In www prefix.
+   *
+   * ```markdown
+   * > | www.example.com
+   *     ^^^^
+   * ```
+   *
+   * @type {State}
+   */
+  function wwwPrefixInside(code) {
+    if ((code === 87 || code === 119) && size < 3) {
+      size++;
+      effects.consume(code);
+      return wwwPrefixInside;
+    }
+    if (code === 46 && size === 3) {
+      effects.consume(code);
+      return wwwPrefixAfter;
+    }
+    return nok(code);
+  }
+
+  /**
+   * After www prefix.
+   *
+   * ```markdown
+   * > | www.example.com
+   *         ^
+   * ```
+   *
+   * @type {State}
+   */
+  function wwwPrefixAfter(code) {
+    // If there is *anything*, we can link.
+    return code === null ? nok(code) : ok(code);
+  }
+}
+
+/**
+ * Domain.
+ *
+ * ```markdown
+ * > | a https://example.org b
+ *               ^^^^^^^^^^^
+ * ```
+ *
+ * @this {TokenizeContext}
+ * @type {Tokenizer}
+ */
+function tokenizeDomain(effects, ok, nok) {
+  /** @type {boolean | undefined} */
+  let underscoreInLastSegment;
+  /** @type {boolean | undefined} */
+  let underscoreInLastLastSegment;
+  /** @type {boolean | undefined} */
+  let seen;
+  return domainInside;
+
+  /**
+   * In domain.
+   *
+   * ```markdown
+   * > | https://example.com/a
+   *             ^^^^^^^^^^^
+   * ```
+   *
+   * @type {State}
+   */
+  function domainInside(code) {
+    // Check whether this marker, which is a trailing punctuation
+    // marker, optionally followed by more trailing markers, and then
+    // followed by an end.
+    if (code === 46 || code === 95) {
+      return effects.check(trail, domainAfter, domainAtPunctuation)(code);
+    }
+
+    // GH documents that only alphanumerics (other than `-`, `.`, and `_`) can
+    // occur, which sounds like ASCII only, but they also support `www.點看.com`,
+    // so that’s Unicode.
+    // Instead of some new production for Unicode alphanumerics, markdown
+    // already has that for Unicode punctuation and whitespace, so use those.
+    // Source: <https://github.com/github/cmark-gfm/blob/ef1cfcb/extensions/autolink.c#L12>.
+    if (
+      code === null ||
+      markdownLineEndingOrSpace(code) ||
+      unicodeWhitespace(code) ||
+      (code !== 45 && unicodePunctuation(code))
+    ) {
+      return domainAfter(code);
+    }
+    seen = true;
+    effects.consume(code);
+    return domainInside;
+  }
+
+  /**
+   * In domain, at potential trailing punctuation, that was not trailing.
+   *
+   * ```markdown
+   * > | https://example.com
+   *                    ^
+   * ```
+   *
+   * @type {State}
+   */
+  function domainAtPunctuation(code) {
+    // There is an underscore in the last segment of the domain
+    if (code === 95) {
+      underscoreInLastSegment = true;
+    }
+    // Otherwise, it’s a `.`: save the last segment underscore in the
+    // penultimate segment slot.
+    else {
+      underscoreInLastLastSegment = underscoreInLastSegment;
+      underscoreInLastSegment = undefined;
+    }
+    effects.consume(code);
+    return domainInside;
+  }
+
+  /**
+   * After domain.
+   *
+   * ```markdown
+   * > | https://example.com/a
+   *                        ^
+   * ```
+   *
+   * @type {State} */
+  function domainAfter(code) {
+    // Note: that’s GH says a dot is needed, but it’s not true:
+    // <https://github.com/github/cmark-gfm/issues/279>
+    if (underscoreInLastLastSegment || underscoreInLastSegment || !seen) {
+      return nok(code);
+    }
+    return ok(code);
+  }
+}
+
+/**
+ * Path.
+ *
+ * ```markdown
+ * > | a https://example.org/stuff b
+ *                          ^^^^^^
+ * ```
+ *
+ * @this {TokenizeContext}
+ * @type {Tokenizer}
+ */
+function tokenizePath(effects, ok) {
+  let sizeOpen = 0;
+  let sizeClose = 0;
+  return pathInside;
+
+  /**
+   * In path.
+   *
+   * ```markdown
+   * > | https://example.com/a
+   *                        ^^
+   * ```
+   *
+   * @type {State}
+   */
+  function pathInside(code) {
+    if (code === 40) {
+      sizeOpen++;
+      effects.consume(code);
+      return pathInside;
+    }
+
+    // To do: `markdown-rs` also needs this.
+    // If this is a paren, and there are less closings than openings,
+    // we don’t check for a trail.
+    if (code === 41 && sizeClose < sizeOpen) {
+      return pathAtPunctuation(code);
+    }
+
+    // Check whether this trailing punctuation marker is optionally
+    // followed by more trailing markers, and then followed
+    // by an end.
+    if (
+      code === 33 ||
+      code === 34 ||
+      code === 38 ||
+      code === 39 ||
+      code === 41 ||
+      code === 42 ||
+      code === 44 ||
+      code === 46 ||
+      code === 58 ||
+      code === 59 ||
+      code === 60 ||
+      code === 63 ||
+      code === 93 ||
+      code === 95 ||
+      code === 126
+    ) {
+      return effects.check(trail, ok, pathAtPunctuation)(code);
+    }
+    if (
+      code === null ||
+      markdownLineEndingOrSpace(code) ||
+      unicodeWhitespace(code)
+    ) {
+      return ok(code);
+    }
+    effects.consume(code);
+    return pathInside;
+  }
+
+  /**
+   * In path, at potential trailing punctuation, that was not trailing.
+   *
+   * ```markdown
+   * > | https://example.com/a"b
+   *                          ^
+   * ```
+   *
+   * @type {State}
+   */
+  function pathAtPunctuation(code) {
+    // Count closing parens.
+    if (code === 41) {
+      sizeClose++;
+    }
+    effects.consume(code);
+    return pathInside;
+  }
+}
+
+/**
+ * Trail.
+ *
+ * This calls `ok` if this *is* the trail, followed by an end, which means
+ * the entire trail is not part of the link.
+ * It calls `nok` if this *is* part of the link.
+ *
+ * ```markdown
+ * > | https://example.com").
+ *                        ^^^
+ * ```
+ *
+ * @this {TokenizeContext}
+ * @type {Tokenizer}
+ */
+function tokenizeTrail(effects, ok, nok) {
+  return trail;
+
+  /**
+   * In trail of domain or path.
+   *
+   * ```markdown
+   * > | https://example.com").
+   *                        ^
+   * ```
+   *
+   * @type {State}
+   */
+  function trail(code) {
+    // Regular trailing punctuation.
+    if (
+      code === 33 ||
+      code === 34 ||
+      code === 39 ||
+      code === 41 ||
+      code === 42 ||
+      code === 44 ||
+      code === 46 ||
+      code === 58 ||
+      code === 59 ||
+      code === 63 ||
+      code === 95 ||
+      code === 126
+    ) {
+      effects.consume(code);
+      return trail;
+    }
+
+    // `&` followed by one or more alphabeticals and then a `;`, is
+    // as a whole considered as trailing punctuation.
+    // In all other cases, it is considered as continuation of the URL.
+    if (code === 38) {
+      effects.consume(code);
+      return trailCharacterReferenceStart;
+    }
+
+    // Needed because we allow literals after `[`, as we fix:
+    // <https://github.com/github/cmark-gfm/issues/278>.
+    // Check that it is not followed by `(` or `[`.
+    if (code === 93) {
+      effects.consume(code);
+      return trailBracketAfter;
+    }
+    if (
+      // `<` is an end.
+      code === 60 ||
+      // So is whitespace.
+      code === null ||
+      markdownLineEndingOrSpace(code) ||
+      unicodeWhitespace(code)
+    ) {
+      return ok(code);
+    }
+    return nok(code);
+  }
+
+  /**
+   * In trail, after `]`.
+   *
+   * > 👉 **Note**: this deviates from `cmark-gfm` to fix a bug.
+   * > See end of <https://github.com/github/cmark-gfm/issues/278> for more.
+   *
+   * ```markdown
+   * > | https://example.com](
+   *                         ^
+   * ```
+   *
+   * @type {State}
+   */
+  function trailBracketAfter(code) {
+    // Whitespace or something that could start a resource or reference is the end.
+    // Switch back to trail otherwise.
+    if (
+      code === null ||
+      code === 40 ||
+      code === 91 ||
+      markdownLineEndingOrSpace(code) ||
+      unicodeWhitespace(code)
+    ) {
+      return ok(code);
+    }
+    return trail(code);
+  }
+
+  /**
+   * In character-reference like trail, after `&`.
+   *
+   * ```markdown
+   * > | https://example.com&amp;).
+   *                         ^
+   * ```
+   *
+   * @type {State}
+   */
+  function trailCharacterReferenceStart(code) {
+    // When non-alpha, it’s not a trail.
+    return asciiAlpha(code) ? trailCharacterReferenceInside(code) : nok(code);
+  }
+
+  /**
+   * In character-reference like trail.
+   *
+   * ```markdown
+   * > | https://example.com&amp;).
+   *                         ^
+   * ```
+   *
+   * @type {State}
+   */
+  function trailCharacterReferenceInside(code) {
+    // Switch back to trail if this is well-formed.
+    if (code === 59) {
+      effects.consume(code);
+      return trail;
+    }
+    if (asciiAlpha(code)) {
+      effects.consume(code);
+      return trailCharacterReferenceInside;
+    }
+
+    // It’s not a trail.
+    return nok(code);
+  }
+}
+
+/**
+ * Dot in email domain trail.
+ *
+ * This calls `ok` if this *is* the trail, followed by an end, which means
+ * the trail is not part of the link.
+ * It calls `nok` if this *is* part of the link.
+ *
+ * ```markdown
+ * > | contact@example.org.
+ *                        ^
+ * ```
+ *
+ * @this {TokenizeContext}
+ * @type {Tokenizer}
+ */
+function tokenizeEmailDomainDotTrail(effects, ok, nok) {
+  return start;
+
+  /**
+   * Dot.
+   *
+   * ```markdown
+   * > | contact@example.org.
+   *                    ^   ^
+   * ```
+   *
+   * @type {State}
+   */
+  function start(code) {
+    // Must be dot.
+    effects.consume(code);
+    return after;
+  }
+
+  /**
+   * After dot.
+   *
+   * ```markdown
+   * > | contact@example.org.
+   *                     ^   ^
+   * ```
+   *
+   * @type {State}
+   */
+  function after(code) {
+    // Not a trail if alphanumeric.
+    return asciiAlphanumeric(code) ? nok(code) : ok(code);
+  }
+}
+
+/**
+ * See:
+ * <https://github.com/github/cmark-gfm/blob/ef1cfcb/extensions/autolink.c#L156>.
+ *
+ * @type {Previous}
+ */
+function previousWww(code) {
+  return (
+    code === null ||
+    code === 40 ||
+    code === 42 ||
+    code === 95 ||
+    code === 91 ||
+    code === 93 ||
+    code === 126 ||
+    markdownLineEndingOrSpace(code)
+  );
+}
+
+/**
+ * See:
+ * <https://github.com/github/cmark-gfm/blob/ef1cfcb/extensions/autolink.c#L214>.
+ *
+ * @type {Previous}
+ */
+function previousProtocol(code) {
+  return !asciiAlpha(code);
+}
+
+/**
+ * @this {TokenizeContext}
+ * @type {Previous}
+ */
+function previousEmail(code) {
+  // Do not allow a slash “inside” atext.
+  // The reference code is a bit weird, but that’s what it results in.
+  // Source: <https://github.com/github/cmark-gfm/blob/ef1cfcb/extensions/autolink.c#L307>.
+  // Other than slash, every preceding character is allowed.
+  return !(code === 47 || gfmAtext(code));
+}
+
+/**
+ * @param {Code} code
+ * @returns {boolean}
+ */
+function gfmAtext(code) {
+  return (
+    code === 43 ||
+    code === 45 ||
+    code === 46 ||
+    code === 95 ||
+    asciiAlphanumeric(code)
+  );
+}
+
+/**
+ * @param {Array<Event>} events
+ * @returns {boolean}
+ */
+function previousUnbalanced(events) {
+  let index = events.length;
+  let result = false;
+  while (index--) {
+    const token = events[index][1];
+    if (
+      (token.type === "labelLink" || token.type === "labelImage") &&
+      !token._balanced
+    ) {
+      result = true;
+      break;
+    }
+
+    // If we’ve seen this token, and it was marked as not having any unbalanced
+    // bracket before it, we can exit.
+    if (token._gfmAutolinkLiteralWalkedInto) {
+      result = false;
+      break;
+    }
+
+    // A run an earlier walk crossed without finding either of the above. Jump
+    // over it instead of re-reading it, so a document whose answer is “yes”
+    // stops costing one full walk per candidate character. The jump is only
+    // taken while the run’s far end still sits at the index it was recorded
+    // at and still holds the same token: a resolver that splices events can
+    // move a token out of the array, and the identity check is what notices.
+    // `skip.index < index` keeps the walk moving backwards whatever the array
+    // has done since.
+    const skip = token._gfmAutolinkLiteralSkipTo;
+    if (
+      skip !== undefined &&
+      skip.index < index &&
+      events[skip.index] !== undefined &&
+      events[skip.index][1] === skip.token
+    ) {
+      index = skip.index + 1;
+    }
+  }
+  if (events.length > 0) {
+    if (!result) {
+      // Mark the last token as “walked into” w/o finding
+      // anything.
+      events[events.length - 1][1]._gfmAutolinkLiteralWalkedInto = true;
+    } else if (index >= 0) {
+      // Record where the walk stopped, so the next one resumes there.
+      events[events.length - 1][1]._gfmAutolinkLiteralSkipTo = {
+        index: index,
+        token: events[index][1],
+      };
+    }
+  }
+  return result;
+}

package/types/gfm.d.mts

@@ -0,0 +1,8 @@
+/**
+ * A unified plugin adding GFM support: autolink literals, footnotes,
+ * strikethrough, tables and task lists — the same set, in the same order, as
+ * `remark-gfm`.
+ * @this {any} unified processor
+ * @returns {undefined}
+ */
+export default function remarkGfmFixed(this: any): undefined;

package/types/vendor/gfm-autolink-literal.d.mts

@@ -0,0 +1,10 @@
+/**
+ * Create an extension for `micromark` to support GitHub autolink literal
+ * syntax.
+ *
+ * @returns {Extension}
+ *   Extension for `micromark` that can be passed in `extensions` to enable GFM
+ *   autolink literal syntax.
+ */
+export function gfmAutolinkLiteral(): Extension;
+import type { Extension } from 'micromark-util-types';