brookmd 0.25.1 → 0.26.0

package/CHANGELOG.md

@@ -4,6 +4,271 @@ Notable changes to brookmd (formerly `flux-md`). Format based on
 [Keep a Changelog](https://keepachangelog.com/); this project aims to follow
 [Semantic Versioning](https://semver.org/).
 
+## 0.26.0 — 2026-07-30
+
+**Rendered HTML bytes change in this release.** Everything new below is opt-in
+and default-off — with the flags off those paths are byte-identical to 0.25.2 —
+but the output-fidelity work is unconditional: container framing newlines,
+paragraph whitespace, table line breaks, fenced-code indentation, and the
+task-list checkbox form now match the CommonMark and GFM reference renderers
+exactly. No API is removed, and the wire envelope, ids, and commit semantics are
+untouched — but HTML snapshots taken against 0.25.x will need regenerating.
+That, not the new features, is why this is a minor bump.
+
+What it buys: **652/652 CommonMark 0.31 and 24/24 GFM, byte-exact** against the
+reference renderers, where before the suites passed only after structural
+normalization. Byte-exactness is now the harnesses' default floor and is pinned
+in CI, so one regressed byte fails the build.
+
+Requires `brookmd-core` 0.25.0.
+
+### Added
+
+- **`softBreaks` — a soft line break renders as `<br>`.** Strict CommonMark
+  treats a bare `\n` inside a paragraph as whitespace, so a model that writes one
+  thought per line gets one reflowed blob. This is the `remark-breaks` /
+  chat-comment convention where one Enter is one visual line, and it is what most
+  chat UIs actually want. Off by default; it only ever *adds* breaks (a hard break
+  is `<br>` either way), so no existing output loses a line.
+- **`allowSchemes` — un-block a URL scheme brookmd blocks by default.** Bare
+  scheme names, no colon (`allowSchemes: ["file"]`), matched case-insensitively.
+  It reaches exactly one tier: the *overridable*-blocked schemes, today `file:`.
+  The script-executing tier (`javascript:`, `data:text/html`, …) is
+  non-overridable — listing one is a silent no-op, not an escape hatch — and the
+  encoded-evasion neutralization (percent- and entity-encoded scheme prefixes) is
+  unchanged and runs before the check. This exists for privileged embedders —
+  Electron shells, extensions, editor preview panes — that intercept link clicks
+  instead of navigating.
+- **`lenientLists` — rescue an over-indented list item from becoming a code
+  block.** CommonMark §5.2 says a marker followed by 5+ columns of whitespace
+  starts an indented code block, so a model emitting `-       const value = 1;`
+  renders a `<pre><code>` instead of a list item. With the flag on, a marker
+  followed by **6 or more columns of literal spaces** absorbs the padding into the
+  content column and the text parses as the item's own markdown. Deliberately
+  narrow: exactly 5 spaces still opens code (that column is the spec boundary
+  itself), a fence on the marker line stays a fence, an indent on a *later* line
+  stays code, and **tab** padding stays code — tabs are an authoring choice, model
+  over-indentation is always literal spaces. Excluding tabs is what holds the
+  divergence to a single spec example (274) and only while the flag is on; the
+  conformance suites run strict and are unaffected.
+- **`blockHtml` — block-level raw HTML through the safe sanitizer.** A
+  `<details><summary>…</summary>…</details>` block rendered as an escaped code
+  block before; now it renders as real elements, sanitized. Only CommonMark HTML
+  block **types 6 and 7** qualify — types 1–5 (`<script>`/`<pre>`/`<style>`/
+  `<textarea>`, comments, processing instructions, declarations, CDATA) stay
+  escaped by design, so the constructs that can execute or swallow the rest of
+  the document never take effect.
+  It shares its token core with the inline raw-HTML path (one policy, not two),
+  tracks an open-tag stack with speculative closers so a half-streamed
+  `<details` never leaks a broken element, carries a void-element table so `<hr>`
+  and friends are not pushed onto that stack, and caps nesting depth at 100.
+  Half-streamed tags are suppressed while open and settle at finalize. Takes
+  effect only when the sanitizer is engaged (`htmlAllowlist` or `dropHtmlTags`);
+  on its own it does nothing.
+- **`CodeBlockData.meta` — the fence info string's remainder.**
+  ```` ```ts title="src/main.ts" ```` now yields `lang: "ts"` **and**
+  `meta: 'title="src/main.ts"'` on the data channel and as a `meta` prop on
+  `components.CodeBlock`. Always-on like `lang` (no `blockData` needed) and
+  omitted entirely when the fence carried none, so a fence without meta is
+  byte-identical to before. It is deliberately **not** in the rendered HTML —
+  there is no `data-meta` attribute — because a filename header is a component's
+  job, not the parser's. While streaming it appears only once it can no longer
+  change (the opening fence line terminated by a newline, or at finalize), so a
+  header never flickers through a half-typed `title="src/ma`.
+- **`ListItemData.start` — a source byte offset per list item.** Under
+  `blockData`, each top-level `items[]` entry carries the document-absolute offset
+  of the byte where its marker begins, same origin as `Block.start` and stable as
+  the document grows. That is enough to build task-checkbox writeback: locate the
+  `[ ]` from the item's offset and flip it in the original markdown, no HTML
+  round-trip. **Nested** items carry no offset rather than a wrong one — a nested
+  list is not a separate block, it renders against a synthesized de-indented
+  string with no document offset — and that limitation is documented on the type.
+- Together `meta` and `start` bump the **wire contract to 1.3.0** (WIRE.md §9):
+  purely additive optional `data` keys, byte-identical when unexercised.
+- All four flags are plumbed through every surface: client/worker config, the
+  server renderer, the `<brook-markdown>` element (`soft-breaks`,
+  `lenient-lists`, `block-html`, `allow-schemes`), React Native, Kotlin, Swift,
+  and the Flutter hand-written config.
+- **Byte-exact conformance mode in the spec harnesses**, with default ratchet
+  floors `CMARK_MIN_EXACT=652` / `GFM_MIN_EXACT=24` — pinned explicitly in both
+  the CI and publish workflows alongside the older normalized floors. The four
+  deliberate differences from the reference (`target`/`rel` on links, `data-lang`
+  on code blocks, HTML5 void `<br>`, `style="text-align:…"` instead of GFM's
+  deprecated `align`) are folded by a documented `canonicalize` step applied to
+  **both** sides — the only transform on the byte-exact path, so it can erase our
+  intentional extras but never hide a structural divergence.
+- **An unconditional `bindings` CI job** — FFI and C-ABI crate tests plus
+  regeneration-freshness checks for the React Native, Kotlin, and Swift bindings.
+  The existing binding workflows only ran on `pull_request` behind `paths:`
+  filters, so a push to main or a JS-only PR gated on nothing; that is how stale
+  binding goldens survived.
+
+### Changed
+
+- **Container inner newlines now match the reference exactly** (cmark's `cr()`
+  rule): `<li>` / `<blockquote>` / alert framing newlines land where the
+  reference puts them, an empty blockquote gets its newline, and a `<li>` opening
+  with a tight paragraph no longer emits a spurious `\n`.
+- **Paragraph whitespace follows the spec line by line.** Leading indentation is
+  stripped on *every* line, not just the first; trailing spaces and tabs are
+  dropped before a soft break; a hard-break line sheds the *next* line's indent.
+  Lazy continuation lines in blockquotes and lists keep their `\n` instead of
+  being glued with a space.
+- **GFM tables emit one element per line**, matching the reference's framing, and
+  task-list checkboxes emit the reference byte-form
+  (`checked="" disabled="" type="checkbox"`).
+- **Fenced code**: the body is de-indented by the opening fence's own indent (so
+  a fence at columns 1–3 no longer carries that indent into every line);
+  significant trailing spaces inside the last line are preserved; interior blank
+  lines before the closer are preserved. Tab-column arithmetic is fixed after
+  blockquote markers, across item-content boundaries, and after list markers.
+- **Document assembly is now defined and documented** ([WIRE.md
+  §12](../../crates/brookmd-core/WIRE.md)): a block's `html` carries **no
+  trailing newline** — the terminator after a top-level block belongs to the
+  document, not the block — and concatenating blocks is a `cr()`-join.
+  `renderToString` follows that rule, so a server-rendered document and a
+  reference render agree byte-for-byte.
+- **Native `BrookConfig` gained four fields** (`soft_breaks`, `allow_schemes`,
+  `lenient_lists`, `block_html`), appended in a newly documented **append-only
+  zone**: uniffi serializes a record's fields *positionally*, so inserting a field
+  anywhere above shifts every later read. The wire was verified to be
+  exact-consumption — a binding built against the old record fails loudly on a
+  version mismatch rather than silently mis-decoding — and the RN, Kotlin, and
+  Swift bindings are regenerated, with the Flutter hand-written config synced
+  (it also gained the previously-missing `wire_delta`). Stale wire goldens across
+  all four languages were re-synced. `brookmd-ffi` and `brookmd-cabi` go to
+  **0.3.0**: the native library and its generated bindings must ship in lockstep.
+
+### Performance
+
+Every item below is pinned by a **wall-time** regression guard in
+`crates/brookmd-core/tests/scaling.rs`, each paired with a flush-control twin
+that isolates the shape from its chunking. That pairing is the point: work
+counters alone provably miss the allocation-class quadratics below — the parser
+was doing O(n) *counted* work while re-allocating O(n) bytes per append, so only
+the clock could see it.
+
+| Shape | Measured as | Before | After |
+| --- | --- | --- | --- |
+| growing fence opener line | growth over an 8× input span | 50.5× | **9.1×** |
+| indented continuation lines | vs the unindented control | 304.6× | **1.1×** |
+| ragged chunks parked on a blank partial line | vs control | 110.2× | **1.1×** |
+| the same, inside a list item | work counters | 212× | **12.8×** |
+| block-HTML sanitize | vs the escaped control | 247× | **1.3×** |
+
+- **Fence opener-line growth** re-sliced the whole opener on every append —
+  quadratic in the info string's length. Now linear-ish: 9.1× over an 8× span.
+- **Indented continuation lines** made `is_boundary` produce *zero* cut
+  candidates, so every append re-rendered the entire paragraph from its start. A
+  new indent-led boundary rule (with a hard-break-straddle exclusion) restores
+  cutting; the shape now costs 1.1× its unindented control.
+- **Ragged chunking that parks on a whitespace-only partial line** dropped the
+  paragraph cache outright, forcing a full rebuild per append. The cache now
+  **suspends instead of dropping**: the closed view stays byte-identical and the
+  parse resumes when the line completes. List items inherit the fix through the
+  nested parser.
+- **Block-level raw HTML** would otherwise re-sanitize its whole body per append
+  (measured 247×); the sanitize cache folds at token boundaries, shipping at 1.3×
+  the cost of the escaped control. Container, table-cell, and heading caches were
+  proven structurally immune to the same class and are pinned so they stay that
+  way.
+
+### Security
+
+- **The raw-HTML attribute policy is now an explicit dropped-attribute table**
+  rather than scheme-checking alone: `srcdoc`, `is`, `autofocus`,
+  `contenteditable`, the DOM-clobbering `id` / `name`, the shadow-piercing
+  `slot` / `part` / `exportparts`, the `form*` family, the `xmlns:` / `xlink:`
+  prefixes, and `ping`. `formaction` and `ping` are **dropped outright** — for a
+  URL carrier that re-targets a form or fires a background beacon, dropping is
+  strictly stronger than validating its scheme. Component-tag props stay
+  permissive by design (they are consumer-mediated — your component decides what
+  to do with them, and they never become DOM attributes); that asymmetry is now
+  documented rather than incidental.
+- **The web component's `gfm-tagfilter` attribute was never observed.** It was in
+  the element's config map but missing from `observedAttributes`, so it applied at
+  mount and then silently ignored every later change — a security-relevant flag
+  that could not be turned on after the fact. Fixed, and the list now carries a
+  comment tying it to the map so the next flag cannot repeat it.
+
+### Fixed
+
+- **A mid-stream committed-view divergence**: a cut taken after a *single*
+  inter-word space could straddle the hard-break lookbehind, so a paragraph
+  containing entity-produced spaces rendered differently mid-stream than it did
+  one-shot. The streamed view now matches the one-shot render at every chunk
+  boundary again.
+
+## brookmd-react-native 0.1.7 — 2026-07-30
+
+### Added
+
+- `softBreaks`, `allowSchemes`, `lenientLists`, and `blockHtml` on the native
+  `BrookConfig`, reaching the on-device parser through the same JSI path as the
+  existing flags. The generated TS/C++ bindings are regenerated from
+  `brookmd-ffi` 0.3.0 and are now freshness-checked on every push by the new CI
+  `bindings` job.
+
+### Changed
+
+- `brookmd` dependency range `^0.25.0` → `^0.26.0`, and the vendored native
+  binaries are built against `brookmd-core` 0.25.0 — so the on-device renderer
+  produces the same reference-exact bytes as the browser. Native and JS must move
+  together here: uniffi records are positional, and the four new `BrookConfig`
+  fields land in the record's append-only zone.
+
+## 0.25.2 — 2026-07-27
+
+Performance only. Rendered output is unchanged — byte-identical mid-stream, not
+just at finalize.
+
+### Fixed
+
+- **An open component block no longer re-scans its whole body on every blank
+  line — O(n²) → O(n).** `try_incremental_component` bailed whenever the fed
+  buffer ended on a blank line, and because the cache had already been taken the
+  bail dropped it, forcing a full tail re-scan, a full re-render, and a fresh
+  nested parser over the entire body. Blank lines are legal component-body
+  content, so that fired once per body paragraph.
+
+  The bail existed for a real reason: when the buffer ends blank the full rescan
+  renders the component and all its sub-blocks with `open_tail = false`, which
+  the nested parser's `force_open_tail = true` commits can never match. Rather
+  than work around it with a trigger-byte heuristic (measured: still 3.9×/doubling
+  on any body containing a backtick or bracket — i.e. all real ones), the cache
+  now carries a **settled twin**: a second nested parser with `force_open_tail`
+  off, fed lazily only on the appends that read it, so each catch-up spans just
+  the bytes since the previous blank line. A body with no blank lines never
+  allocates it. The cache now arms once per stream instead of once per paragraph.
+
+  Streaming a 64 KB `<Thinking>` body, scan work and wall time:
+
+  | body | before | after |
+  | --- | --- | --- |
+  | plain paragraphs | 117,333,095 B / 11,954 ms | 229,837 B / **269 ms** |
+  | with inline code | 101,046,887 B / 9,316 ms | 224,977 B / **226 ms** |
+  | with links | 86,362,310 B / 6,837 ms | 220,835 B / **180 ms** |
+  | with `$` and `<` | 117,333,095 B / 7,333 ms | 229,837 B / **388 ms** |
+
+  Scan and render work are now 2.00×/doubling (dead linear); the residual
+  3.3–3.6×/doubling in wall time is a separate, pre-existing cliff —
+  `assemble_wrapped_body` re-materializes an open block's HTML every append —
+  which the already-registered `open-block-html-reemit` shape sits in too.
+
+  **Trade-off:** the twin holds a second copy of an open component's body bytes
+  plus one rendered-HTML set, freed when the block closes. Roughly 2× transient
+  memory for open component blocks *that contain blank lines*; blank-free bodies
+  are unaffected.
+
+### Added
+
+- `tests/scaling.rs` gains `component_multi_para` and `component_multi_para_rich`
+  (backticks, brackets, `$`, `<`), both gated `Linear`. The existing
+  `component_block_open` shape generates no blank lines and so was structurally
+  blind to this: its `scanned` is a flat 249 B from 8 KB to 64 KB. The new shapes
+  measure 252.4× on the pre-fix parser (gate fails) and 16.0× over a 16× span
+  after.
+
 ## 0.25.1 — 2026-07-27
 
 A correction release. 0.25.0 shipped one user-visible regression and a dev-gate
@@ -49,6 +314,15 @@ memory leak on the opt-in `childMemo` path. Upgrade from 0.25.0.
   id, kind, override keys, HTML excerpt, the error) and moves only the
   explanatory prose behind the dev gate.
 
+## brookmd-react-native 0.1.6 — 2026-07-27
+
+### Fixed
+
+- Vendored native binaries rebuilt against `brookmd-core` 0.24.2, which makes an
+  open component block's streaming cost linear in its body. This matters more
+  on-device than in the browser: the pre-fix path spent ~24 s of native CPU on a
+  64 KB token-streamed `<Thinking>` body. No JS changes.
+
 ## brookmd-react-native 0.1.5 — 2026-07-27
 
 ### Fixed

package/README.md

@@ -461,6 +461,17 @@ export default function Doc({ md }: { md: string }) {
 - **`renderToString(md, { config })`** — synchronous HTML string, **zero React
   dependency** (imports cleanly with no `react` installed).
 - **`parseToBlocks(md, { config })`** — the block array, for custom rendering.
+
+**Document assembly.** A `Block.html` never ends with a newline — the terminator
+that follows a top-level block belongs to the *document*, not the block.
+`renderToString` therefore joins blocks with cmark's `cr()` rule: insert `\n`
+before a block only when the output doesn't already end with one, and end the
+document with one `\n`. An unconditional `"\n".join(...)` would double the
+newline a raw HTML block serializes for itself. **If you assemble
+`parseToBlocks` output into a document string yourself, use the same rule** —
+it's what makes the output byte-identical to a reference CommonMark/GFM renderer
+(652/652 CommonMark 0.31 and 24/24 GFM extension examples, byte-for-byte). See
+`WIRE.md` §12.
 - **`<BrookMarkdownStatic content config components />`** (from
   `brookmd/server/react`) — synchronous React tree for **render-once** contexts;
   render it with your framework's server renderer
@@ -614,12 +625,16 @@ const client = new BrookClient({
     gfmFootnotes: true,   // [^1] + [^1]: → footnote section (default false)
     gfmMath: true,        // $…$ / \(…\) inline + $$…$$ / \[…\] display math (default false)
     dirAuto: true,        // per-block dir="auto" for RTL/bidi text (default false)
+    softBreaks: true,     // a single \n renders as <br> (remark-breaks / chat convention; default false)
+    lenientLists: true,   // marker + 6+ SPACES → item text, not indented code (default false)
     a11y: true,           // task-list <label> + <th scope="col"> a11y markup (default false)
     unsafeHtml: false,    // pass raw HTML through (default false — keep it false for untrusted input)
     componentTags: ["Thinking", "Callout"], // BLOCK custom tags w/ markdown inside (default none)
     inlineComponentTags: ["tik", "cite"],   // INLINE custom tags (chips/citations) w/ markdown inside (default none)
     htmlAllowlist: ["br", "sub", "sup"],    // safe raw-HTML sanitizer: [] = allow all but dangerous; list = only those (default off)
     dropHtmlTags: [],                        // tags removed entirely (comments always dropped when sanitizing; default off)
+    blockHtml: true,                         // extend the sanitizer to BLOCK raw HTML (<details>…); needs a list above (default false)
+    allowSchemes: ["file"],                  // un-block a default-blocked URL scheme (default none — see "Security")
     blockData: true,      // opt-in structured kind.data per block (default false — see "Structured block data")
   },
 });
@@ -640,6 +655,32 @@ When to enable each flag:
   definitions. Off by default; see the footnote streaming caveat above.
 - `dirAuto: true` — when content can be RTL / mixed-direction. Emits per-block
   `dir="auto"` so the browser detects direction independently per block.
+- `lenientLists: true` — when your LLM over-indents after a list marker. Strict
+  CommonMark (§5.2) says a marker followed by **5 or more** columns of
+  whitespace starts an indented code block, so a model writing
+  `-       const value = 1;` renders as a `<pre><code>` block instead of a list
+  item. This flag raises that cutoff to **6 columns of literal spaces**: at 6+
+  the padding is absorbed into the item's content column and the text renders
+  as the item's own markdown (inline formatting, links, and nested lists all
+  parse normally). Off by default, so strict-CommonMark output is unchanged.
+
+  Four cases stay strictly conformant **by design** — the flag is deliberately
+  narrow, not a general "fix my indentation" pass:
+
+  | Input | Stays | Why |
+  | --- | --- | --- |
+  | `-` + exactly 5 spaces | code block | 5 columns is the §5.2 boundary itself; relaxing it would swallow genuine one-space-past-the-minimum code |
+  | `` - ```js `` (fence on the marker line) | fenced code | the marker line opens a real fence — there is no over-indentation to undo |
+  | `-` then code indented on a **later** line | code block | the decision reads only the marker's own line; a later-line indent is unambiguous authored code |
+  | `-\t\tfoo` (tab padding) | code block | tab padding is a deliberate authoring choice, unlike model over-indentation which is always literal spaces |
+
+  Excluding tabs is what keeps the divergence from CommonMark down to a single
+  spec example (274, `1.` + 6 spaces). Everything else in the 652-example suite
+  renders identically with the flag on or off; the conformance suites
+  themselves run in strict mode and are unaffected.
+
+  The rule is a pure per-line comparison made when the marker is first scanned,
+  so it costs no lookahead and no re-parse while streaming.
 - `a11y: true` — opt-in accessibility markup that deviates from strict GFM
   byte-output: wraps task-list checkboxes in a `<label>` (screen-reader
   association) and adds `scope="col"` to table headers. Off by default so
@@ -664,6 +705,15 @@ When to enable each flag:
 - `htmlAllowlist` / `dropHtmlTags` — render a **safe subset of raw HTML** (e.g.
   `<br>`, `<sub>`, `<sup>`) natively without `unsafeHtml`, drop specific tags, and
   drop HTML comments. See [Safe raw HTML](#safe-raw-html).
+- `blockHtml: true` — extend that sanitizer to **block-level** raw HTML, so a
+  `<details><summary>…</summary>…</details>` block renders as real elements
+  instead of an escaped code block. Needs one of the two lists above to be set;
+  `<script>`/`<pre>`/`<style>`/`<textarea>` blocks stay escaped. See
+  [Block-level raw HTML](#block-level-raw-html-blockhtml).
+- `allowSchemes: ["file"]` — un-block a URL scheme brookmd blocks by default,
+  for privileged hosts (Electron, extensions) that intercept link clicks instead
+  of navigating. Script-executing schemes can never be re-enabled. See
+  [Un-blocking a scheme](#un-blocking-a-scheme--allowschemes).
 
 **Footnotes** (`gfmFootnotes`) work in streaming with one honest caveat: a
 `[^1]` reference renders speculatively the moment it's seen (committed blocks
@@ -763,8 +813,9 @@ attributes (with `class`→`className` and `style` as an object) plus `children`
 **Block-kind** keys (`CodeBlock`, `Mermaid`, `MathBlock`, `Alert`, `Paragraph`,
 `Heading`, `List`, `Blockquote`, `Table`, `Rule`, `Html`) replace the entire
 block. The component receives [`BlockComponentProps`](#types): `{ block, html,
-open, speculative }`, plus `text`/`language` for code/math blocks (the alert
-type is at `block.kind.data.kind`).
+open, speculative }`, plus `text`/`language` for code/math blocks — and `meta`,
+the rest of a fence's info string (```` ```ts title="src/main.ts" ````), for a
+filename header (the alert type is at `block.kind.data.kind`).
 
 > **One map, two prop contracts — the single biggest footgun.** The keys above
 > are looked up by TWO dispatchers. The block-kind dispatcher passes
@@ -866,7 +917,7 @@ byte-identical, so non-users pay nothing.
 |------|-------------------|------|-----|
 | `Table` | `{ headers, rows, aligns }`, cells `{ text, html }` | `props.table` | sort / filter / transpose / CSV / chart |
 | `Heading` | `{ level, text, id }` | `props.heading` | table of contents with anchors |
-| `CodeBlock` | `{ lang, code }` | `props.code` | decoded source (copy / run) |
+| `CodeBlock` | `{ lang, meta?, code }` | `props.code` | decoded source (copy / run) |
 | `MathBlock` | `{ latex }` | `props.math` | LaTeX source (re-render) |
 | `List` | `{ ordered, start }` | `props.list` | ordered-list numbering |
 
@@ -1004,11 +1055,77 @@ new BrookClient({ config: { htmlAllowlist: [] } });
   text stays as inert text).
 - Every rendered tag's **attributes are sanitized**: `on*` handlers and `style`
   (a CSS beacon / clickjacking vector) are dropped, and dangerous URL schemes
-  (`javascript:`, …, including multi-encoded) become `#`.
-- **Scope:** *inline* raw HTML. Block-level raw HTML stays escaped for now (use
-  `unsafeHtml` **without** the sanitizer to render block HTML — when the sanitizer
-  is engaged, block HTML stays escaped even if `unsafeHtml` is also on). Tag
-  matching is case-insensitive.
+  (`javascript:`, …, including multi-encoded) become `#` — in `href`, `src`,
+  `srcset`, `poster`, `cite`, `action`, `data`, `longdesc` and `background`.
+- A further set of **DOM-hazard attributes is dropped outright** (case-insensitive)
+  — they neither execute nor carry a URL, but each lets authored markup reach
+  past the text it should be:
+  `srcdoc` (inline document injection), `is` (customized-built-in upgrade),
+  `autofocus` / `contenteditable` (focus-steal, UI spoof), `id` / `name` (DOM
+  clobbering — an element shadowing `document.getElementById` or a global),
+  `slot` / `part` / `exportparts` (shadow-DOM injection), `form`, `formaction`,
+  `formenctype`, `formmethod`, `formnovalidate`, `formtarget` (form hijack),
+  `xmlns` / `xlink:*` (namespace escape hatch), and `ping` (tracking beacon).
+  Some are inert *today* only because the tag that gives them meaning is already
+  in the dangerous set — they are dropped anyway so the policy never depends on
+  that coincidence. `class`, `title`, `alt`, `target`, `rel`, `data-*` and
+  `aria-*` are unaffected.
+- **This applies to raw HTML only.** [Component tags](#component-tags) stay
+  permissive: their attributes become framework *props* on `components[tag]`, so
+  `<Tab id="x">` keeps `id` — the consumer's component decides whether it ever
+  reaches the DOM. `on*`, `style` and dangerous URL schemes are filtered there too.
+- **Scope:** *inline* raw HTML by default. Block-level raw HTML stays escaped
+  unless you also set `blockHtml` (below). Tag matching is case-insensitive.
+
+#### Block-level raw HTML (`blockHtml`)
+
+A model that emits a disclosure widget on its own lines —
+
+```html
+<details>
+<summary>Sources</summary>
+Three filings and a transcript.
+</details>
+```
+
+— produces an *HTML block*, not inline HTML, so the sanitizer above leaves it
+escaped. Opt in with `blockHtml` and it renders as real elements:
+
+```ts
+new BrookClient({ config: { htmlAllowlist: [], blockHtml: true } });
+// or restrict it:
+new BrookClient({ config: { htmlAllowlist: ["details", "summary"], blockHtml: true } });
+```
+
+- **Only meaningful with the sanitizer engaged.** `blockHtml` on its own does
+  nothing; it extends `htmlAllowlist` / `dropHtmlTags` to block level. Default
+  `false`, so existing sanitizer users keep escaped block HTML until they opt in.
+- **Same policy, no exceptions.** Tags go through the same allow / drop /
+  non-overridable-dangerous decision and the same hardened attribute policy as
+  inline raw HTML — a block-level `<div onclick=… id=… srcdoc=…>` renders as a
+  bare `<div>`.
+- **Scope: CommonMark HTML block types 6 and 7** — a known block-level tag
+  (`<details>`, `<div>`, `<table>`, `<section>`, …) or any other complete tag
+  alone on its line. **Types 1–5 stay escaped/dropped**, as with the flag off:
+  type 1 is the raw-text family (`<script>`, `<pre>`, `<style>`, `<textarea>`),
+  where a browser reads everything after the opening tag as unparsed text — so a
+  *speculative* close mid-stream is an mXSS vector — and types 2–5 (comments,
+  processing instructions, CDATA, declarations) carry no renderable element at
+  all. A block `<script>` is escaped in every configuration, including with
+  `script` explicitly allowlisted and `unsafeHtml` also on.
+- **Streaming: speculative closers.** While the block is still arriving, every
+  still-open element gets a closer appended, so the HTML you have received *so
+  far* is always a complete tree — `<div>\n<b>bol` renders as
+  `<div><b>bol</b></div>`, and the closers simply stop being speculative when the
+  author's own `</b></div>` lands (the emitted bytes don't change). A half-arrived
+  tag (`<spa`, `<a href="htt`) renders as **nothing** until it completes, the same
+  pending-invisible contract as a streaming markdown link's URL; if the stream
+  ends on one, it settles as escaped text. Mis-nesting is repaired rather than
+  propagated: `<b><i></b>` emits `<b><i></i></b>`, and a close tag matching
+  nothing open is dropped. A type-6/7 block ends at a blank line even with tags
+  open — the closers land there.
+- **Markdown inside the HTML is not parsed** (the body is text + tags). That —
+  full `rehype-raw` semantics — is a later stage.
 
 ### Types
 
@@ -1033,7 +1150,8 @@ interface BlockComponentProps {
   open: boolean;
   speculative: boolean;
   text?: string;      // decoded source — CodeBlock / MathBlock
-  language?: string;  // info string — CodeBlock
+  language?: string;  // info string, first word — CodeBlock
+  meta?: string;      // info string, the rest (`title="src/main.ts"`) — CodeBlock
 }
 ```
 
@@ -1051,14 +1169,35 @@ const html = highlight("const x = 1;", "ts");
 
 ## Coverage
 
-**CommonMark 0.31: 100% (652/652 spec examples)** — every section, including
-the hard ones (nested/loose lists, link reference definitions, link precedence,
-lazy blockquote continuation). Plus GFM extensions: tables, strikethrough, task
-lists, extended autolinks, GitHub alerts (`> [!NOTE]` → styled callouts),
-footnotes (`[^1]` + `[^1]:`), and math (`$…$`, `$$…$$`, `\(…\)`, `\[…\]`).
-Autolinks and alerts are on by default; footnotes and math are opt-in per stream
-(see [Per-stream config](#per-stream-config)). See
-`crates/brookmd-core/tests/{cmark_spec,gfm_spec,footnotes,math}.rs` for runners and floors.
+**CommonMark 0.31: 100% (652/652 spec examples), byte-exact** — every section,
+including the hard ones (nested/loose lists, link reference definitions, link
+precedence, lazy blockquote continuation). Plus GFM extensions, also **24/24
+byte-exact**: tables, strikethrough, task lists, extended autolinks, GitHub
+alerts (`> [!NOTE]` → styled callouts), footnotes (`[^1]` + `[^1]:`), and math
+(`$…$`, `$$…$$`, `\(…\)`, `\[…\]`). Autolinks and alerts are on by default;
+footnotes and math are opt-in per stream (see
+[Per-stream config](#per-stream-config)).
+
+*Byte-exact* means the full output string matches the reference renderer's
+byte-for-byte — not a structurally normalized or whitespace-forgiving compare.
+Both counts are the harnesses' **default** floors (`CMARK_MIN_EXACT=652`,
+`GFM_MIN_EXACT=24`, pinned explicitly in the CI workflows), so a single byte of
+regression fails the build even when the normalized tally stays green.
+
+The only deviations from the reference output are deliberate brookmd choices,
+folded by a documented `canonicalize` step applied to **both** sides before
+comparison — the only transform on the byte-exact path, so it can erase our
+intentional extras but never hide a structural divergence:
+
+| Deliberate difference | Reference emits |
+|---|---|
+| `target="_blank" rel="noopener noreferrer nofollow"` on links (security-only) | no such attrs |
+| `data-lang="…"` on code blocks (alongside `class="language-…"`) | `class` only |
+| HTML5 void elements (`<br>`) | XHTML self-closing (`<br />`) |
+| `style="text-align:…"` on table cells | GFM's deprecated `align="…"` |
+
+See `crates/brookmd-core/tests/{cmark_spec,gfm_spec,footnotes,math}.rs` for the
+runners, the `canonicalize` source, and the floors.
 
 GitHub alerts render to GitHub-compatible markup
 (`<div class="markdown-alert markdown-alert-note">…`), so existing markdown CSS
@@ -1125,17 +1264,61 @@ brookmd is XSS-safe by default — its HTML output is meant to be injected via
 - **Raw HTML is escaped** (the `unsafeHtml: true` config flag disables this;
   **never enable it for untrusted input without a `sanitize` hook**).
 - **Dangerous URL schemes are neutralized** in `<a href>` and `<img src>` —
-  `javascript:`, `vbscript:`, `data:text/html`, `data:text/javascript` become
-  `#`. The check runs on the *decoded* URL and strips characters browsers
-  ignore in the scheme, so obfuscations like `javascript&#58;…`,
-  `javascript\:…`, `&#106;avascript:…`, and embedded tabs/newlines are caught,
-  not just the literal form. (See `crates/brookmd-core/tests/security.rs`.)
+  `javascript:`, `vbscript:`, `data:text/html`, `data:text/javascript` (and
+  `file:`, see below) become `#`. The check runs on the *decoded* URL and strips
+  characters browsers ignore in the scheme, so obfuscations like
+  `javascript&#58;…`, `javascript\:…`, `&#106;avascript:…`, and embedded
+  tabs/newlines are caught, not just the literal form. (See
+  `crates/brookmd-core/tests/security.rs`.)
+- **The opt-in raw-HTML sanitizer removes DOM-hazard attributes.** Beyond `on*`,
+  `style` and URL schemes, [Safe raw HTML](#safe-raw-html) drops `srcdoc`, `is`,
+  `autofocus`, `contenteditable`, `id`/`name` (DOM clobbering), `slot`/`part`/
+  `exportparts`, the `form*` family and `ping` from raw tags — a denylist by
+  *policy*, not one that happens to be safe because some other tag is blocked.
+  brookmd's own generated ids (footnote `fn-N`/`fnref-N`, heading slugs) are
+  emitted by the renderer and never pass through the sanitizer, so they are
+  unaffected. Component-tag props are exempt (see that section).
 - **`htmlToReact` defends in depth**: it drops inline `on*` event-handler
   attributes and runs URL attributes through the same scheme filter. It's
   intended for brookmd's own (already-sanitized) HTML; if you hand it arbitrary
   third-party HTML, these guards are your only line of defense — prefer a
   dedicated HTML sanitizer for genuinely hostile input.
 
+### Un-blocking a scheme — `allowSchemes`
+
+`file:` is blocked by default. It can't execute script, but it has no legitimate
+use in untrusted/LLM markdown, and in a **privileged** host — Electron, a browser
+extension, a page on a `file://` origin — a live `file:` href is a
+local-resource-disclosure / phishing vector. In an ordinary browser tab blocking
+it costs nothing anyway: a page simply **refuses to navigate** to a `file:` URL,
+so the href is inert there either way.
+
+Some hosts genuinely need it. A coding-agent UI whose model links to local paths
+wants the href present so it can **intercept the click** and open the file in an
+editor or preview pane. `allowSchemes` is the opt-in for exactly that:
+
+```ts
+const client = new BrookClient({ config: { allowSchemes: ["file"] } });
+```
+
+- Takes **bare scheme names, no colon** (`["file"]`), matched
+  case-insensitively.
+- It **never restricts** anything — this is not a general allowlist. Schemes
+  outside the built-in blocklist (`vscode:`, `ftp:`, `mailto:`, …) already render
+  today and are unaffected by this setting.
+- The **script-executing tier is non-overridable**: `javascript:`, `vbscript:`,
+  `data:text/html`, `data:text/javascript`, and the scriptable `data:` media
+  types (`data:image/svg`, `data:application/xhtml`, `data:text/xml`, …) stay
+  blocked no matter what you list. Naming one is a silent no-op — the same rule
+  as `htmlAllowlist`, where allowlisting `<script>` still cannot re-enable it.
+- Applies uniformly to links, URI autolinks, images, and sanitized URL
+  attributes.
+
+Turning it on moves the risk to you: **intercept link clicks rather than letting
+navigation happen**, and treat the path as untrusted input at the point you act
+on it. In a privileged host, whether a model-authored `file:///…` is allowed to
+reach a real file is the embedder's decision, not brookmd's.
+
 ### Rendering untrusted / LLM HTML safely
 
 If you enable `unsafeHtml` to render HTML from an untrusted source (e.g. an LLM

package/dist/block-props.js

@@ -38,8 +38,9 @@ function blockProps(block) {
   if (block.kind.type === "CodeBlock") {
     props.text = data?.code ?? decodeCodeText(block.html);
     props.language = data?.lang ?? "";
+    if (typeof data?.meta === "string") props.meta = data.meta;
     if (typeof data?.code === "string") {
-      props.code = { lang: data.lang ?? null, code: data.code };
+      props.code = { lang: data.lang ?? null, meta: data.meta, code: data.code };
     }
   } else if (block.kind.type === "MathBlock") {
     props.text = data?.latex ?? decodeMathText(block.html);

package/dist/element.js

@@ -9,18 +9,25 @@ function parseTriBool(value) {
 const CONFIG_ATTRS = [
   "gfm-autolinks",
   "gfm-alerts",
+  // Must mirror the `set(...)` map below: this list feeds `observedAttributes`,
+  // so an attribute missing here is read once at mount and then never reacts to
+  // a change. `gfm-tagfilter` was in the map but not in this list.
+  "gfm-tagfilter",
   "gfm-footnotes",
   "gfm-math",
   "dir-auto",
+  "lenient-lists",
+  "soft-breaks",
   "a11y",
-  "unsafe-html"
+  "unsafe-html",
+  "block-html"
 ];
 function defineBrookMarkdown(tag = "brook-markdown") {
   if (typeof customElements === "undefined") return;
   if (customElements.get(tag)) return;
   class BrookMarkdownElement extends HTMLElement {
     static get observedAttributes() {
-      return ["markdown", "src", "component-tags", ...CONFIG_ATTRS];
+      return ["markdown", "src", "component-tags", "allow-schemes", ...CONFIG_ATTRS];
     }
     #client = null;
     #ownsClient = false;
@@ -150,8 +157,11 @@ function defineBrookMarkdown(tag = "brook-markdown") {
       set("gfm-footnotes", "gfmFootnotes");
       set("gfm-math", "gfmMath");
       set("dir-auto", "dirAuto");
+      set("lenient-lists", "lenientLists");
+      set("soft-breaks", "softBreaks");
       set("a11y", "a11y");
       set("unsafe-html", "unsafeHtml");
+      set("block-html", "blockHtml");
       const tags = this.getAttribute("component-tags");
       if (tags !== null) {
         const list = tags.split(/[\s,]+/).filter(Boolean);
@@ -160,6 +170,14 @@ function defineBrookMarkdown(tag = "brook-markdown") {
           any = true;
         }
       }
+      const schemes = this.getAttribute("allow-schemes");
+      if (schemes !== null) {
+        const list = schemes.split(/[\s,]+/).filter(Boolean);
+        if (list.length > 0) {
+          cfg.allowSchemes = list;
+          any = true;
+        }
+      }
       return any ? cfg : void 0;
     }
     // Lazily create the internal client from config attributes (self-owned).

package/dist/react.js

@@ -218,8 +218,9 @@ function blockKindProps(block, components) {
   if (block.kind.type === "CodeBlock") {
     props.text = data?.code ?? decodeCodeText(block.html);
     props.language = data?.lang ?? "";
+    if (typeof data?.meta === "string") props.meta = data.meta;
     if (typeof data?.code === "string") {
-      props.code = { lang: data.lang ?? null, code: data.code };
+      props.code = { lang: data.lang ?? null, meta: data.meta, code: data.code };
     }
   } else if (block.kind.type === "MathBlock") {
     props.text = data?.latex ?? decodeMathText(block.html);

package/dist/server.d.ts

@@ -21,10 +21,21 @@ export declare function parseToBlocks(markdown: string, opts?: {
 }): Block[];
 /**
  * Render a complete markdown string to an HTML string synchronously — no worker,
- * no React. The concatenated per-block HTML (XSS-safe with `unsafeHtml` off).
- * For component dispatch / a `<BrookMarkdown>`-matching React tree, use
- * `BrookMarkdownStatic` from `brookmd/server/react` with your framework's server
- * renderer instead.
+ * no React. The per-block HTML joined into one document (XSS-safe with
+ * `unsafeHtml` off). For component dispatch / a `<BrookMarkdown>`-matching React
+ * tree, use `BrookMarkdownStatic` from `brookmd/server/react` with your
+ * framework's server renderer instead.
+ *
+ * **Document assembly** (WIRE.md §12): a block's `html` never ends with a
+ * newline — that terminator belongs to the document, not the block — so joining
+ * blocks inserts one `\n` between them, `cr()`-style: only when the previous
+ * block does not ALREADY end with one. A raw HTML block serializes its own
+ * trailing newline, so an unconditional join would double it. The document ends
+ * with a final newline. This is exactly what a reference CommonMark/GFM renderer
+ * emits, and what the spec harnesses measure byte-for-byte against.
+ *
+ * If you assemble `Block.html` yourself (rather than calling this), use the same
+ * rule.
  */
 export declare function renderToString(markdown: string, opts?: {
     config?: ParserConfig;

package/dist/server.js

@@ -40,6 +40,8 @@ function makeParser(config) {
   p.setGfmFootnotes(config?.gfmFootnotes ?? false);
   p.setGfmMath(config?.gfmMath ?? false);
   p.setDirAuto(config?.dirAuto ?? false);
+  p.setLenientLists(config?.lenientLists ?? false);
+  p.setSoftBreaks(config?.softBreaks ?? false);
   p.setA11y(config?.a11y ?? false);
   p.setUnsafeHtml(config?.unsafeHtml ?? false);
   p.setComponentTags(config?.componentTags ?? []);
@@ -49,6 +51,8 @@ function makeParser(config) {
     config?.htmlAllowlist ?? [],
     config?.dropHtmlTags ?? []
   );
+  p.setBlockHtml(config?.blockHtml ?? false);
+  p.setAllowSchemes(config?.allowSchemes ?? []);
   p.setBlockData(config?.blockData ?? false);
   return p;
 }
@@ -71,7 +75,13 @@ function parseToBlocks(markdown, opts) {
   }
 }
 function renderToString(markdown, opts) {
-  return parseToBlocks(markdown, opts).map((b) => b.html).join("");
+  let out = "";
+  for (const b of parseToBlocks(markdown, opts)) {
+    if (out.length > 0 && !out.endsWith("\n")) out += "\n";
+    out += b.html;
+  }
+  if (out.length > 0 && !out.endsWith("\n")) out += "\n";
+  return out;
 }
 export {
   initBrook,

package/dist/types-core.d.ts

@@ -89,15 +89,24 @@ export interface HeadingData {
     id: string;
 }
 /**
- * A CodeBlock's `kind.data` when {@link ParserConfig.blockData} is on. `lang` is
- * the always-on info-string language (`null` for none); `code` is the opt-in
- * DECODED source inside `<pre><code>…</code></pre>` (only present when `blockData`
- * is on). Build a copy-to-clipboard string / re-highlight from `code` alone — no
- * HTML re-parse, no entity-decode. When `blockData` is off, `code` is absent and
- * `kind.data` is just `{ lang }`, byte-identical to before.
+ * A CodeBlock's `kind.data`. `lang` is the always-on info-string language (`null`
+ * for none) — the info string's first word; `meta` is the always-on REMAINDER of
+ * that same info string, trimmed (```` ```ts title="src/main.ts" ```` ⇒
+ * `lang: "ts"`, `meta: 'title="src/main.ts"'`), absent when the fence carried
+ * none. `code` is the opt-in DECODED source inside `<pre><code>…</code></pre>`
+ * (only present when `blockData` is on). Build a copy-to-clipboard string /
+ * re-highlight from `code` alone — no HTML re-parse, no entity-decode. When
+ * `blockData` is off, `code` is absent and `kind.data` is just `{ lang }` (plus
+ * `meta` if the fence had one), byte-identical to before.
+ *
+ * Both halves are the RAW info-string text (backslash escapes / entity references
+ * left undecoded), and only `lang` appears in the rendered HTML
+ * (`class="language-…" data-lang="…"`) — there is deliberately no `data-meta`
+ * attribute, so a filename header needs a `components.CodeBlock` override.
  */
 export interface CodeBlockData {
     lang: string | null;
+    meta?: string;
     code?: string;
 }
 /**
@@ -117,6 +126,24 @@ export interface MathBlockData {
  */
 export interface ListItemData {
     html: string;
+    /**
+     * The item's DOCUMENT-ABSOLUTE source byte offset — the index, in the markdown
+     * fed so far, of the byte where this item's marker (`-`, `*`, `1.`, …) begins.
+     * Same origin as {@link Block.start}, and stable as the document grows (the
+     * parser's buffer is append-only), so `source.slice(item.start)` always begins
+     * at this item's marker. Use it to read or rewrite the item in place — e.g.
+     * find the task-list checkbox with your own `findTaskListMarkerOffset(source,
+     * item.start)` and flip `[ ]` ⇄ `[x]` in the original string.
+     *
+     * Present only when {@link ParserConfig.blockData} is on.
+     *
+     * KNOWN LIMITATION — absent for NESTED list items. A nested list is not a
+     * separate block: its items live inside the parent item's `html` and never
+     * reach the `items` channel, and the nested render runs against a synthesized
+     * de-indented string with no document offset. Nested items therefore carry no
+     * offset rather than a wrong one. Only top-level list items get a `start`.
+     */
+    start?: number;
 }
 /**
  * A List's `kind.data` when {@link ParserConfig.blockData} is on. `ordered` is the
@@ -243,6 +270,18 @@ export interface BlockComponentProps {
     text?: string;
     /** Info-string language — present for `CodeBlock` (from `kind.data.lang`). */
     language?: string;
+    /**
+     * Info-string META — everything after the language word, trimmed (from
+     * `kind.data.meta`), e.g. `title="src/main.ts"` or a bare `src/main.ts`.
+     * Always-on like `language` (no `blockData` needed); `undefined` when the
+     * fence carried none. Deliberately absent from the rendered HTML, so render a
+     * filename header from this prop.
+     *
+     * While streaming it appears once it can no longer change — when the opening
+     * fence line is terminated by a newline, or at finalize — so a header never
+     * flickers through a half-typed `title="src/ma`.
+     */
+    meta?: string;
     /** Component tag name — present for `Component` blocks (from `kind.data.tag`). */
     tag?: string;
     /**
@@ -274,11 +313,12 @@ export interface BlockComponentProps {
     heading?: HeadingData;
     /**
      * Structured code data — present for `CodeBlock` blocks when
-     * {@link ParserConfig.blockData} is on (otherwise `undefined`). `{ lang, code }`
-     * with `code` the DECODED source. Build a copy-to-clipboard string / re-highlight
-     * from `code` — no HTML re-parse, no entity-decode. (`props.text` / `props.language`
-     * carry the same source / lang and stay populated even when off, via the HTML
-     * regex fallback.)
+     * {@link ParserConfig.blockData} is on (otherwise `undefined`). `{ lang, meta?,
+     * code }` with `code` the DECODED source. Build a copy-to-clipboard string /
+     * re-highlight from `code` — no HTML re-parse, no entity-decode. (`props.text` /
+     * `props.language` carry the same source / lang and stay populated even when off,
+     * via the HTML regex fallback; `props.meta` carries the same meta and is
+     * always-on, since it has no HTML form to fall back to.)
      */
     code?: CodeBlockData;
     /**
@@ -343,6 +383,28 @@ export interface ParserConfig {
      * apps that render RTL or mixed-direction content.
      */
     dirAuto?: boolean;
+    /**
+     * Lenient list indentation: a list marker followed by 6 or more columns of
+     * SPACE padding yields the item's text, where strict CommonMark (§5.2) keeps
+     * one column and renders the rest as an indented code block. Default false.
+     *
+     * Aimed at model output, which routinely over-indents after a bullet
+     * (`-       const value = 1;`). Four cases stay strictly conformant: exactly
+     * 5 columns of padding, a fenced code block opened on the marker line itself,
+     * indented code that starts on a line AFTER the marker, and tab-padded
+     * markers (`-\t\tfoo`).
+     */
+    lenientLists?: boolean;
+    /**
+     * Render a CommonMark SOFT line break (a bare `\n` inside inline content) as
+     * a `<br>` — the `remark-breaks` / "GitHub comment" convention, where one
+     * Enter is one visual line. Default false (strict CommonMark: a soft break is
+     * whitespace). Hard breaks (two trailing spaces, or a trailing `\`) are `<br>`
+     * either way, so enabling this only ADDS breaks — it never removes one. Chat
+     * UIs streaming model output usually want this on, since models emit single
+     * newlines expecting a visible break.
+     */
+    softBreaks?: boolean;
     /**
      * Opt-in accessibility markup that deviates from strict GFM byte-output:
      * wraps a task-list checkbox + its text in a `<label>` (programmatic
@@ -385,8 +447,8 @@ export interface ParserConfig {
      * `input`, `svg`, …); a **non-empty** array renders only those tags (e.g.
      * `["br","sub","sup"]`) and escapes the rest. Every rendered tag's attributes
      * are sanitized (event handlers dropped, dangerous URL schemes → `#`), and HTML
-     * comments are dropped. Block-level raw HTML stays escaped (sanitize is
-     * inline-scoped for now). Unset/omitted = off (raw HTML handling unchanged).
+     * comments are dropped. Block-level raw HTML stays escaped unless you also set
+     * {@link blockHtml}. Unset/omitted = off (raw HTML handling unchanged).
      * Matching is case-insensitive. See also {@link dropHtmlTags}.
      */
     htmlAllowlist?: string[];
@@ -397,6 +459,52 @@ export interface ParserConfig {
      * raw-HTML sanitizer (see {@link htmlAllowlist}). Case-insensitive.
      */
     dropHtmlTags?: string[];
+    /**
+     * Extend the safe raw-HTML sanitizer to **block-level** raw HTML, so a model
+     * emitting `<details><summary>…</summary>…</details>` on its own lines renders
+     * as real elements instead of an escaped code block. Only takes effect when
+     * the sanitizer is engaged ({@link htmlAllowlist} / {@link dropHtmlTags}); on
+     * its own it does nothing. Default false — existing sanitizer users keep
+     * escaped block HTML until they opt in.
+     *
+     * Scope is CommonMark HTML block **types 6 and 7**: a known block-level tag
+     * (`<details>`, `<div>`, `<table>`, …) or any other complete tag alone on its
+     * line. Types 1–5 stay escaped/dropped: type 1 is the raw-text family
+     * (`<script>`, `<pre>`, `<style>`, `<textarea>`) — a browser reads everything
+     * after such a tag as unparsed text, so a speculative mid-stream close is
+     * mXSS-prone — and types 2–5 (comments, PIs, CDATA, declarations) carry no
+     * renderable element. The tag allow/drop/dangerous decision and the hardened
+     * attribute policy are exactly the inline sanitizer's.
+     *
+     * While the block streams, still-open elements get **speculative closers**, so
+     * what the reader has seen so far is a complete tree at every append; a
+     * half-arrived tag stays invisible until it completes. Markdown *inside* the
+     * HTML is not parsed (the body is text + tags).
+     */
+    blockHtml?: boolean;
+    /**
+     * Opt-in **un-blocklist** for URL schemes that brookmd blocks by default.
+     * Bare scheme names, **without** the colon (`["file"]`), matched
+     * case-insensitively. Empty/omitted = the built-in policy is unchanged.
+     *
+     * This never *restricts* anything — it is not a general allowlist. Schemes
+     * outside the built-in blocklist (`vscode:`, `ftp:`, `mailto:`, …) already
+     * render today and are unaffected. The only tier it can reach is the
+     * overridable-blocked one, currently just `file:`.
+     *
+     * The script-executing tier — `javascript:`, `vbscript:`, `data:text/html`,
+     * `data:text/javascript`, and the scriptable `data:` media types
+     * (`data:image/svg`, `data:application/xhtml`, …) — is **non-overridable**:
+     * listing one here is a silent no-op, exactly as allowlisting `<script>`
+     * cannot re-enable it via {@link htmlAllowlist}.
+     *
+     * Only enable `file:` in a host that intercepts link clicks instead of
+     * navigating (an Electron / extension UI that opens the path in an editor);
+     * local-resource disclosure then becomes the embedder's responsibility.
+     * Applies uniformly to links, URI autolinks, images, and sanitized URL
+     * attributes.
+     */
+    allowSchemes?: string[];
     /**
      * Opt-in structured table data. When on, a `Table` block's `kind.data` is
      * populated with `{ headers, rows, aligns }` (each cell `{ text, html }`) so a

package/dist/wasm/README.md

@@ -52,13 +52,13 @@ entirely:
 
 ```toml
 [dependencies]
-brookmd-core = { version = "0.23", default-features = false }
+brookmd-core = { version = "0.25", default-features = false }
 ```
 
 ## Wire format
 
 Blocks and patches serialize to a stable, language-agnostic JSON wire format —
-see [WIRE.md](WIRE.md) (wire contract v1.2.0). Native consumers can produce the
+see [WIRE.md](WIRE.md) (wire contract v1.3.0). Native consumers can produce the
 same bytes as the WASM/JS boundary via `wire::patch_to_json` / `wire::blocks_to_json`.
 
 Contract v1.2.0 adds the opt-in **wire delta mode**

package/dist/wasm/brook_md_core.d.ts

@@ -38,6 +38,18 @@ export class BrookParser {
      * to table header cells. Off by default (conformance output unchanged).
      */
     setA11y(on: boolean): void;
+    /**
+     * Un-block specific URL schemes that are blocked by DEFAULT — bare scheme
+     * names without the colon (`["file"]`), matched case-insensitively. Empty
+     * by default (built-in policy unchanged). This never RESTRICTS anything:
+     * schemes outside the built-in blocklist (`vscode:`, `ftp:`, …) already
+     * pass. The script-executing tier (`javascript:`, `vbscript:`,
+     * `data:text/html`, `data:text/javascript`, scriptable `data:` media types)
+     * is non-overridable — listing one here is a no-op. Only enable `file:` in
+     * a host that intercepts link clicks instead of navigating (Electron,
+     * extensions); local-resource disclosure is then the embedder's call.
+     */
+    setAllowSchemes(schemes: string[]): void;
     /**
      * Opt-in structured `kind.data` channel for Table blocks: a Table then
      * carries `{ headers, rows, aligns }` (per-cell `{ text, html }`) so a
@@ -46,6 +58,17 @@ export class BrookParser {
      * as `{"type":"Table"}` (no `data` key) and output is byte-identical.
      */
     setBlockData(on: boolean): void;
+    /**
+     * Extend the safe raw-HTML sanitizer to BLOCK-level raw HTML — a
+     * `<details><summary>…` block renders as real elements instead of escaping
+     * into a code block. Takes effect ONLY when the sanitizer is engaged
+     * (`setHtmlSanitize`), and only for CommonMark HTML block types 6 and 7.
+     * Types 1–5 (`<script>`/`<pre>`/`<style>`/`<textarea>`, comments, PIs,
+     * CDATA, declarations) stay escaped/dropped. Still-open elements get
+     * speculative closers while the block streams, so the emitted HTML is a
+     * complete tree at every prefix. Off by default (output unchanged).
+     */
+    setBlockHtml(on: boolean): void;
     /**
      * Set the opt-in component-tag allowlist (e.g. `["Thinking", "Callout"]`).
      * A `<Tag>…</Tag>` whose name is listed renders as a component whose inner
@@ -107,6 +130,23 @@ export class BrookParser {
      * cells, and list items. Empty by default (inline output unchanged).
      */
     setInlineComponentTags(tags: string[]): void;
+    /**
+     * Lenient list indentation: a list marker followed by 6+ columns of SPACE
+     * padding yields the item's text instead of an indented code block. Off by
+     * default (strict CommonMark §5.2). Useful for model output, which routinely
+     * over-indents after a bullet. Exactly-5-column padding, a fence opened on
+     * the marker line, indented code starting on a later line, and tab-padded
+     * markers all stay strictly conformant.
+     */
+    setLenientLists(on: boolean): void;
+    /**
+     * Render a CommonMark SOFT line break (a bare `\n` in inline content) as a
+     * `<br>` — the `remark-breaks` convention, where one Enter is one visual
+     * line. Off by default (strict CommonMark: a soft break is whitespace).
+     * Hard breaks (two trailing spaces / trailing `\`) are `<br>` either way,
+     * so turning this on only ADDS breaks; it never removes one.
+     */
+    setSoftBreaks(on: boolean): void;
     /**
      * Enable or disable raw-HTML pass-through. Default off. Do not enable
      * when rendering untrusted input — bypasses XSS protection.
@@ -135,7 +175,9 @@ export interface InitOutput {
     readonly brookparser_new: () => number;
     readonly brookparser_retainedBytes: (a: number) => number;
     readonly brookparser_setA11y: (a: number, b: number) => void;
+    readonly brookparser_setAllowSchemes: (a: number, b: number, c: number) => void;
     readonly brookparser_setBlockData: (a: number, b: number) => void;
+    readonly brookparser_setBlockHtml: (a: number, b: number) => void;
     readonly brookparser_setComponentTags: (a: number, b: number, c: number) => void;
     readonly brookparser_setDirAuto: (a: number, b: number) => void;
     readonly brookparser_setGfmAlerts: (a: number, b: number) => void;
@@ -145,6 +187,8 @@ export interface InitOutput {
     readonly brookparser_setGfmTagfilter: (a: number, b: number) => void;
     readonly brookparser_setHtmlSanitize: (a: number, b: number, c: number, d: number, e: number, f: number) => void;
     readonly brookparser_setInlineComponentTags: (a: number, b: number, c: number) => void;
+    readonly brookparser_setLenientLists: (a: number, b: number) => void;
+    readonly brookparser_setSoftBreaks: (a: number, b: number) => void;
     readonly brookparser_setUnsafeHtml: (a: number, b: number) => void;
     readonly brookparser_setWireDelta: (a: number, b: number) => void;
     readonly __wbindgen_export: (a: number, b: number) => number;

package/dist/wasm/brook_md_core.js

@@ -138,6 +138,23 @@ export class BrookParser {
     setA11y(on) {
         wasm.brookparser_setA11y(this.__wbg_ptr, on);
     }
+    /**
+     * Un-block specific URL schemes that are blocked by DEFAULT — bare scheme
+     * names without the colon (`["file"]`), matched case-insensitively. Empty
+     * by default (built-in policy unchanged). This never RESTRICTS anything:
+     * schemes outside the built-in blocklist (`vscode:`, `ftp:`, …) already
+     * pass. The script-executing tier (`javascript:`, `vbscript:`,
+     * `data:text/html`, `data:text/javascript`, scriptable `data:` media types)
+     * is non-overridable — listing one here is a no-op. Only enable `file:` in
+     * a host that intercepts link clicks instead of navigating (Electron,
+     * extensions); local-resource disclosure is then the embedder's call.
+     * @param {string[]} schemes
+     */
+    setAllowSchemes(schemes) {
+        const ptr0 = passArrayJsValueToWasm0(schemes, wasm.__wbindgen_export);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.brookparser_setAllowSchemes(this.__wbg_ptr, ptr0, len0);
+    }
     /**
      * Opt-in structured `kind.data` channel for Table blocks: a Table then
      * carries `{ headers, rows, aligns }` (per-cell `{ text, html }`) so a
@@ -149,6 +166,20 @@ export class BrookParser {
     setBlockData(on) {
         wasm.brookparser_setBlockData(this.__wbg_ptr, on);
     }
+    /**
+     * Extend the safe raw-HTML sanitizer to BLOCK-level raw HTML — a
+     * `<details><summary>…` block renders as real elements instead of escaping
+     * into a code block. Takes effect ONLY when the sanitizer is engaged
+     * (`setHtmlSanitize`), and only for CommonMark HTML block types 6 and 7.
+     * Types 1–5 (`<script>`/`<pre>`/`<style>`/`<textarea>`, comments, PIs,
+     * CDATA, declarations) stay escaped/dropped. Still-open elements get
+     * speculative closers while the block streams, so the emitted HTML is a
+     * complete tree at every prefix. Off by default (output unchanged).
+     * @param {boolean} on
+     */
+    setBlockHtml(on) {
+        wasm.brookparser_setBlockHtml(this.__wbg_ptr, on);
+    }
     /**
      * Set the opt-in component-tag allowlist (e.g. `["Thinking", "Callout"]`).
      * A `<Tag>…</Tag>` whose name is listed renders as a component whose inner
@@ -247,6 +278,29 @@ export class BrookParser {
         const len0 = WASM_VECTOR_LEN;
         wasm.brookparser_setInlineComponentTags(this.__wbg_ptr, ptr0, len0);
     }
+    /**
+     * Lenient list indentation: a list marker followed by 6+ columns of SPACE
+     * padding yields the item's text instead of an indented code block. Off by
+     * default (strict CommonMark §5.2). Useful for model output, which routinely
+     * over-indents after a bullet. Exactly-5-column padding, a fence opened on
+     * the marker line, indented code starting on a later line, and tab-padded
+     * markers all stay strictly conformant.
+     * @param {boolean} on
+     */
+    setLenientLists(on) {
+        wasm.brookparser_setLenientLists(this.__wbg_ptr, on);
+    }
+    /**
+     * Render a CommonMark SOFT line break (a bare `\n` in inline content) as a
+     * `<br>` — the `remark-breaks` convention, where one Enter is one visual
+     * line. Off by default (strict CommonMark: a soft break is whitespace).
+     * Hard breaks (two trailing spaces / trailing `\`) are `<br>` either way,
+     * so turning this on only ADDS breaks; it never removes one.
+     * @param {boolean} on
+     */
+    setSoftBreaks(on) {
+        wasm.brookparser_setSoftBreaks(this.__wbg_ptr, on);
+    }
     /**
      * Enable or disable raw-HTML pass-through. Default off. Do not enable
      * when rendering untrusted input — bypasses XSS protection.

package/dist/wasm/brook_md_core_bg.wasm.d.ts

@@ -9,7 +9,9 @@ export const brookparser_finalize: (a: number, b: number) => void;
 export const brookparser_new: () => number;
 export const brookparser_retainedBytes: (a: number) => number;
 export const brookparser_setA11y: (a: number, b: number) => void;
+export const brookparser_setAllowSchemes: (a: number, b: number, c: number) => void;
 export const brookparser_setBlockData: (a: number, b: number) => void;
+export const brookparser_setBlockHtml: (a: number, b: number) => void;
 export const brookparser_setComponentTags: (a: number, b: number, c: number) => void;
 export const brookparser_setDirAuto: (a: number, b: number) => void;
 export const brookparser_setGfmAlerts: (a: number, b: number) => void;
@@ -19,6 +21,8 @@ export const brookparser_setGfmMath: (a: number, b: number) => void;
 export const brookparser_setGfmTagfilter: (a: number, b: number) => void;
 export const brookparser_setHtmlSanitize: (a: number, b: number, c: number, d: number, e: number, f: number) => void;
 export const brookparser_setInlineComponentTags: (a: number, b: number, c: number) => void;
+export const brookparser_setLenientLists: (a: number, b: number) => void;
+export const brookparser_setSoftBreaks: (a: number, b: number) => void;
 export const brookparser_setUnsafeHtml: (a: number, b: number) => void;
 export const brookparser_setWireDelta: (a: number, b: number) => void;
 export const __wbindgen_export: (a: number, b: number) => number;

package/dist/worker.js

@@ -15,6 +15,8 @@ const core = new WorkerCore({
     p.setGfmFootnotes(c?.gfmFootnotes ?? false);
     p.setGfmMath(c?.gfmMath ?? false);
     p.setDirAuto(c?.dirAuto ?? false);
+    p.setLenientLists(c?.lenientLists ?? false);
+    p.setSoftBreaks(c?.softBreaks ?? false);
     p.setA11y(c?.a11y ?? false);
     p.setUnsafeHtml(c?.unsafeHtml ?? false);
     p.setComponentTags(c?.componentTags ?? []);
@@ -24,6 +26,8 @@ const core = new WorkerCore({
       c?.htmlAllowlist ?? [],
       c?.dropHtmlTags ?? []
     );
+    p.setBlockHtml(c?.blockHtml ?? false);
+    p.setAllowSchemes(c?.allowSchemes ?? []);
     p.setBlockData(c?.blockData ?? false);
     p.setWireDelta(true);
     return p;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brookmd",
-  "version": "0.25.1",
+  "version": "0.26.0",
   "description": "Zero-dep streaming markdown for the browser. Rust→WASM core, Web Worker per stream, incremental parse with speculative closure.",
   "type": "module",
   "sideEffects": ["./dist/worker.js", "./dist/styles.css"],