securemark 0.258.7 → 0.259.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.259.0
+
+- Extend cite syntax to accept URL.
+
+## 0.258.9
+
+- Refactoring.
+
+## 0.258.8
+
+- Refactoring.
+
 ## 0.258.7
 
 - Refactoring.

package/design.md

@@ -285,13 +285,13 @@ CodeMirrorが素では速いがVimModeでは数万文字程度でも耐え難く
 ### バックトラック
 
 SecuremarkのAnnotation構文に典型的であるように文脈を変更する構文の中にその文脈に依存し変更される他の構文が存在する場合一般に文脈の相違から解析結果を再利用不能な(`αA'β | αAB`)バックトラックが生じる。文脈依存構文の解析中に文脈により解釈の異なる字句(`[a[`)または現在の文脈を終了する字句(ただの括弧がスコープを作らない場合の`(([a))`)に遭遇したとき、現在の文脈での解析の継続を試行する解析方法はメモ化なしではバックトラックが再帰的に生じ線形時間で解析できず、現在の文脈での解析を中止し直前の文脈を継続または新たな文脈を開始する解析方法はバックトラックなしで線形時間で解析できる。
-CommonMarkはLink構文から明らかなように後者の解析方法により重篤なバックトラックなしで(インラインでは)ほぼ1回の走査で解析できる言語であるが同時にこれは文脈依存構文の正当な入れ子表現(`[<a@b>]`)を解析できないか不正な表現(`[<a@b>]()`)を除外できず二重リンク(`<a><a></a></a>`)を生成する、文脈依存構文の存在する数に応じて多項式的(おそらく$n^{2+c}$)に構文の壊れやすさの増す脆く拡張性の低い言語であることを意味する(構文の決定を遅延できれば解決できるがこれにより他の構文の解釈が非決定的にならない場合に限られる)。この問題はおそらくメモ化により解決できるがCommonMarkは実行性能追及のためメモ化を廃止しており二重リンクも放置しているためメモ化により性能を低下させてまで解決するつもりはないと思われる(すなわちCommonMarkは機械を至上とし人間に制約を課す低水準の言語であり人間の需要を至上とするSecuremarkとは対極に位置する)。
-従ってほぼ1回の走査で解析可能な文法に制約されるCommonMarkには文脈依存構文を入れ子表現の広範な制限ならびに構文の可読性および開始記号の信頼性の多項式的な低下と引き換えにしか追加できないという拡張性の欠陥が存在する。CommonMarkの仕様策定者が構文の拡張に(名称を維持するか否かにかかわらず)不自然なまでに消極的または進展がないのは正当な理由や怠慢からでなく文脈依存構文を追加するにつれて構文解析戦略の欠陥が明白になっていくためおよび現在の高い実行性能を低下させたくないためである。`~~a~~`のような文脈自由構文は容易に追加できるがこうしたマージンを失えばもはや後はない。
-Securemarkは線形時間で解析不能な前者の解析方法を各種最適化によりおおよそ4n以下の最悪計算量に改善しさらに解析時間と解析範囲の局限により一定時間内で解析不能な入力の影響を局限することでこれらの問題を解決している。この解析方法はほとんどの自然な入力に対して線形に近い時間で効率的に動作し、最悪計算量で低速に動作させる少数の機械的攻撃入力に対してもサーバーで多数のユーザーのリクエストに応じるには低速で脆弱性となる可能性があるがクライアントで単一のユーザーの操作に応じるには十分高速であるためクライアントで解析する限り解析の効率または速度が実用上問題となることはない。
+CommonMarkはLink構文から明らかなように後者の解析方法により重篤なバックトラックなし(作者によると、だがHTML構文とAutolink構文では再帰的バックトラックが生じるのはないか？)で(インラインでは)ほぼ1回の走査で解析できる言語であるが同時にこれは文脈依存構文の正当な入れ子表現(`[<a@b>]`)を解析できないか不正な表現(`[<a@b>]()`)を除外できず二重リンク(`<a><a></a></a>`)を生成する、文脈依存構文の存在する数に応じて多項式的(おそらく$n^{2+c}$)に構文の壊れやすさの増す脆く拡張性の低い言語であることを意味する(構文の決定を遅延できれば解決できるがこれにより他の構文の解釈が非決定的にならない場合に限られる。そしてCommonMarkは角括弧(`<>`)の対応を取っていないためAutolink構文は自身の解釈が非決定的になると後続の構文の解釈も非決定的になる)。この問題はおそらくメモ化により解決できるがCommonMarkは実行性能追及のためメモ化を廃止しており二重リンクも放置しているためメモ化により性能を低下させてまで解決するつもりはないと思われる(すなわちCommonMarkは機械を至上とし人間に制約を課す低水準の言語であり人間の需要を至上とするSecuremarkとは対極に位置する)。
+従って現在のほぼ1回の走査で解析可能な文法に制約されるCommonMarkには文脈依存構文を入れ子表現の広範な制限ならびに構文の可読性および開始記号の信頼性の多項式的な低下と引き換えにしか追加できないという拡張性の欠陥が存在する。CommonMarkの仕様策定者が構文の拡張に(名称を維持するか否かにかかわらず)不自然なまでに消極的または進展がないのは正当な理由や怠慢からでなく文脈依存構文を追加するにつれて構文解析戦略の欠陥が明白になっていくためおよび現在の高い実行性能を低下させたくないためである。`~~a~~`のような文脈自由構文は容易に追加できるがこうしたマージンを失えばもはや後はない。CommonMarkは小さく単純であるがゆえに正しくいられる象牙の塔であり仕様策定者はこの正しさを失わず正しいままでいたいがために象牙の塔に引きこもり小さな完全性を固持し続けているのである(でなければ何年も隠さず速やかにこの拡張性の欠如を公表して助力を求めていなければならない)。
+Securemarkは線形時間で解析不能な前者の解析方法をメモ化によりおおよそ4n以下の最悪計算量に改善しさらに解析時間と解析範囲の局限により一定時間内で解析不能な入力の影響を局限することでこれらの問題を解決している。この解析方法はほとんどの自然な入力に対して1nに近い時間で効率的に動作し、最悪計算量で低速に動作させる少数の機械的攻撃入力に対してもサーバーで多数のユーザーのリクエストに応じるには低速で脆弱性となる可能性があるがクライアントで単一のユーザーの操作に応じるには十分高速であるためクライアントで解析する限り解析の効率または速度が実用上問題となることはない。
 
 ### メモ化
 
-一部の文脈依存言語を線形時間で解析できるようになるとしても状態数に応じて複数回走査が必要なこと、これにより時間効率が定性的には改善されても定量的には文脈自由言語より数倍悪いこと、オーバーヘッドが有意に大きいこと、時間の代わりに空間効率が非線形に悪化する可能性があることなどから理論上同じ線形時間だとしても実用上文脈自由言語と同等の実行性能にはならず文脈依存言語を文脈自由言語と等価の選択肢にするものではない。
+一部の文脈依存言語を線形時間で解析できるようになるとしても状態数に応じて複数回走査が必要なこと、このため時間効率が定性的には改善されても定量的には文脈自由言語より数倍悪いこと、オーバーヘッドが有意に大きいことなどから理論上同じ線形時間だとしても実用上文脈自由言語と同等の実行性能にはならず文脈依存言語と文脈自由言語を等価の選択肢にするものではない。
 
 ### 最適化
 

package/dist/index.js

@@ -1,4 +1,4 @@
-/*! securemark v0.258.7 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED License */
+/*! securemark v0.259.0 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED License */
 (function webpackUniversalModuleDefinition(root, factory) {
 	if(typeof exports === 'object' && typeof module === 'object')
 		module.exports = factory(require("DOMPurify"), require("Prism"));
@@ -2884,6 +2884,7 @@ exports.syntax = syntax;
 
 function creation(cost, parser) {
   if (typeof cost === 'function') return creation(1, cost);
+  if (cost === 0) return parser;
   return (source, context) => {
     const {
       resources = {
@@ -5286,6 +5287,10 @@ exports.cite = (0, combinator_1.creation)((0, combinator_1.line)((0, combinator_
   class: 'anchor'
 }, '>>.')], '']), (0, combinator_1.focus)(/^>>#\S*[^\S\n]*(?:$|\n)/, source => [[(0, dom_1.html)('a', {
   class: 'anchor'
+}, source)], '']), (0, combinator_1.focus)(/^>>https?:\/\/\w\S*[^\S\n]*(?:$|\n)/, source => [[(0, dom_1.html)('a', {
+  class: 'anchor',
+  href: source.slice(2).trimEnd(),
+  target: '_blank'
 }, source)], ''])])]))), ([el, quotes = '']) => [(0, dom_1.html)('span', {
   class: 'cite'
 }, (0, dom_1.defrag)([`${quotes}>`, (0, dom_1.define)(el, {
@@ -5700,13 +5705,13 @@ const dom_1 = __webpack_require__(3252);
 
 exports.annotation = (0, combinator_1.lazy)(() => (0, combinator_1.surround)('((', (0, combinator_1.constraint)(64
 /* State.annotation */
-, false, (0, combinator_1.syntax)(32
-/* Syntax.annotation */
-, 6, 1, (0, combinator_1.state)(64
+, false, (0, combinator_1.state)(64
 /* State.annotation */
 | 2
 /* State.media */
-, (0, visibility_1.startLoose)((0, combinator_1.context)({
+, (0, combinator_1.syntax)(32
+/* Syntax.annotation */
+, 6, 1, (0, visibility_1.startLoose)((0, combinator_1.context)({
   delimiters: global_1.undefined
 }, (0, combinator_1.some)((0, combinator_1.union)([inline_1.inline]), ')', [[/^\\?\n/, 9], [')', 2], ['))', 6]])), ')')))), '))', false, ([, ns], rest) => [[(0, dom_1.html)('sup', {
   class: 'annotation'
@@ -5777,7 +5782,7 @@ const source_1 = __webpack_require__(6743);
 const dom_1 = __webpack_require__(3252); // https://example/@user must be a user page or a redirect page going there.
 
 
-exports.account = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('@', (0, combinator_1.tails)([(0, combinator_1.verify)((0, source_1.str)(/^[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?)*\//), ([source]) => source.length <= 253 + 1), (0, combinator_1.verify)((0, source_1.str)(/^[A-Za-z][0-9A-Za-z]*(?:-[0-9A-Za-z]+)*/), ([source]) => source.length <= 64)])), (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `https://${source.slice(1).replace('/', '/@')}` : `/${source}`} }`, (0, combinator_1.union)([link_1.textlink]))), ([el]) => [(0, dom_1.define)(el, {
+exports.account = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('@', (0, combinator_1.tails)([(0, combinator_1.verify)((0, source_1.str)(/^[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?)*\//), ([source]) => source.length <= 253 + 1), (0, combinator_1.verify)((0, source_1.str)(/^[A-Za-z][0-9A-Za-z]*(?:-[0-9A-Za-z]+)*/), ([source]) => source.length <= 64)])), (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `https://${source.slice(1).replace('/', '/@')}` : `/${source}`} }`, (0, combinator_1.union)([link_1.unsafelink]))), ([el]) => [(0, dom_1.define)(el, {
   class: 'account'
 })]));
 
@@ -5806,7 +5811,7 @@ const dom_1 = __webpack_require__(3252); // Timeline(pseudonym): user/tid
 // 外部表現は投稿ごとに投稿者の投稿時のタイムゾーンに統一する(非時系列順)
 
 
-exports.anchor = (0, combinator_1.lazy)(() => (0, combinator_1.validate)('>>', (0, combinator_1.fmap)((0, combinator_1.focus)(/^>>(?:[A-Za-z][0-9A-Za-z]*(?:-[0-9A-Za-z]+)*\/)?[0-9A-Za-z]+(?:-[0-9A-Za-z]+)*(?![0-9A-Za-z@#:])/, (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `/@${source.slice(2).replace('/', '/timeline/')}` : `?at=${source.slice(2)}`} }`, (0, combinator_1.union)([link_1.textlink]))), ([el]) => [(0, dom_1.define)(el, {
+exports.anchor = (0, combinator_1.lazy)(() => (0, combinator_1.validate)('>>', (0, combinator_1.fmap)((0, combinator_1.focus)(/^>>(?:[A-Za-z][0-9A-Za-z]*(?:-[0-9A-Za-z]+)*\/)?[0-9A-Za-z]+(?:-[0-9A-Za-z]+)*(?![0-9A-Za-z@#:])/, (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `/@${source.slice(2).replace('/', '/timeline/')}` : `?at=${source.slice(2)}`} }`, (0, combinator_1.union)([link_1.unsafelink]))), ([el]) => [(0, dom_1.define)(el, {
   class: 'anchor'
 })])));
 
@@ -5893,7 +5898,7 @@ const source_1 = __webpack_require__(6743);
 
 const dom_1 = __webpack_require__(3252);
 
-exports.hashnum = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('#', (0, source_1.str)(new RegExp(/^[0-9]{1,16}(?![^\p{C}\p{S}\p{P}\s]|emoji|['_])/u.source.replace(/emoji/, hashtag_1.emoji), 'u'))), (0, combinator_1.convert)(source => `[${source}]{ ${source.slice(1)} }`, (0, combinator_1.union)([link_1.textlink]))), ([el]) => [(0, dom_1.define)(el, {
+exports.hashnum = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('#', (0, source_1.str)(new RegExp(/^[0-9]{1,16}(?![^\p{C}\p{S}\p{P}\s]|emoji|['_])/u.source.replace(/emoji/, hashtag_1.emoji), 'u'))), (0, combinator_1.convert)(source => `[${source}]{ ${source.slice(1)} }`, (0, combinator_1.union)([link_1.unsafelink]))), ([el]) => [(0, dom_1.define)(el, {
   class: 'hashnum',
   href: null
 })]));
@@ -5922,7 +5927,7 @@ const dom_1 = __webpack_require__(3252); // https://example/hashtags/a must be a
 
 
 exports.emoji = String.raw`\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation}|\p{Emoji}\uFE0F`;
-exports.hashtag = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('#', (0, combinator_1.tails)([(0, combinator_1.verify)((0, source_1.str)(/^[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?)*\//), ([source]) => source.length <= 253 + 1), (0, combinator_1.verify)((0, source_1.str)(new RegExp([/^(?=[0-9]{0,127}_?(?:[^\d\p{C}\p{S}\p{P}\s]|emoji))/u.source, /(?:[^\p{C}\p{S}\p{P}\s]|emoji|_(?=[^\p{C}\p{S}\p{P}\s]|emoji)){1,128}/u.source, /(?!_?(?:[^\p{C}\p{S}\p{P}\s]|emoji)|')/u.source].join('').replace(/emoji/g, exports.emoji), 'u')), ([source]) => source.length <= 128)])), (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `https://${source.slice(1).replace('/', '/hashtags/')}` : `/hashtags/${source.slice(1)}`} }`, (0, combinator_1.union)([link_1.textlink]))), ([el]) => [(0, dom_1.define)(el, {
+exports.hashtag = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('#', (0, combinator_1.tails)([(0, combinator_1.verify)((0, source_1.str)(/^[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?)*\//), ([source]) => source.length <= 253 + 1), (0, combinator_1.verify)((0, source_1.str)(new RegExp([/^(?=[0-9]{0,127}_?(?:[^\d\p{C}\p{S}\p{P}\s]|emoji))/u.source, /(?:[^\p{C}\p{S}\p{P}\s]|emoji|_(?=[^\p{C}\p{S}\p{P}\s]|emoji)){1,128}/u.source, /(?!_?(?:[^\p{C}\p{S}\p{P}\s]|emoji)|')/u.source].join('').replace(/emoji/g, exports.emoji), 'u')), ([source]) => source.length <= 128)])), (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `https://${source.slice(1).replace('/', '/hashtags/')}` : `/hashtags/${source.slice(1)}`} }`, (0, combinator_1.union)([link_1.unsafelink]))), ([el]) => [(0, dom_1.define)(el, {
   class: 'hashtag'
 }, el.innerText)]));
 
@@ -5946,7 +5951,7 @@ const link_1 = __webpack_require__(9628);
 const source_1 = __webpack_require__(6743);
 
 const closer = /^[-+*=~^,.;:!?]*(?=[\\"`|\[\](){}<>]|$)/;
-exports.url = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['http://', 'https://'], (0, combinator_1.rewrite)((0, combinator_1.open)(/^https?:\/\/(?=[\x21-\x7E])/, (0, combinator_1.focus)(/^[\x21-\x7E]+/, (0, combinator_1.some)((0, combinator_1.union)([bracket, (0, combinator_1.some)(source_1.unescsource, closer)])))), (0, combinator_1.convert)(url => `{ ${url} }`, (0, combinator_1.union)([link_1.textlink])))));
+exports.url = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['http://', 'https://'], (0, combinator_1.rewrite)((0, combinator_1.open)(/^https?:\/\/(?=[\x21-\x7E])/, (0, combinator_1.focus)(/^[\x21-\x7E]+/, (0, combinator_1.some)((0, combinator_1.union)([bracket, (0, combinator_1.some)(source_1.unescsource, closer)])))), (0, combinator_1.convert)(url => `{ ${url} }`, (0, combinator_1.union)([link_1.unsafelink])))));
 const bracket = (0, combinator_1.lazy)(() => (0, combinator_1.creation)((0, combinator_1.precedence)(2, (0, combinator_1.union)([(0, combinator_1.surround)('(', (0, combinator_1.some)((0, combinator_1.union)([bracket, source_1.unescsource]), ')'), ')', true), (0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([bracket, source_1.unescsource]), ']'), ']', true), (0, combinator_1.surround)('{', (0, combinator_1.some)((0, combinator_1.union)([bracket, source_1.unescsource]), '}'), '}', true), (0, combinator_1.surround)('"', (0, combinator_1.precedence)(8, (0, combinator_1.some)(source_1.unescsource, '"')), '"', true)]))));
 
 /***/ }),
@@ -6252,9 +6257,7 @@ const dom_1 = __webpack_require__(3252);
 
 exports.index = (0, combinator_1.lazy)(() => (0, combinator_1.validate)('[#', (0, combinator_1.fmap)((0, indexee_1.indexee)((0, combinator_1.surround)('[#', (0, combinator_1.constraint)(16
 /* State.index */
-, false, (0, combinator_1.syntax)(1024
-/* Syntax.index */
-, 2, 1, (0, combinator_1.state)(64
+, false, (0, combinator_1.state)(64
 /* State.annotation */
 | 32
 /* State.reference */
@@ -6268,7 +6271,9 @@ exports.index = (0, combinator_1.lazy)(() => (0, combinator_1.validate)('[#', (0
 /* State.media */
 | 1
 /* State.autolink */
-, (0, visibility_1.startTight)((0, combinator_1.open)((0, source_1.stropt)(/^\|?/), (0, visibility_1.trimBlankEnd)((0, combinator_1.some)((0, combinator_1.union)([signature, inline_1.inline]), ']', [[/^\\?\n/, 9], [']', 2]])), true))))), ']', false, ([, ns], rest) => [[(0, dom_1.html)('a', (0, dom_1.defrag)(ns))], rest])), ([el]) => [(0, dom_1.define)(el, {
+, (0, combinator_1.syntax)(1024
+/* Syntax.index */
+, 2, 1, (0, visibility_1.startTight)((0, combinator_1.open)((0, source_1.stropt)(/^\|?/), (0, visibility_1.trimBlankEnd)((0, combinator_1.some)((0, combinator_1.union)([signature, inline_1.inline]), ']', [[/^\\?\n/, 9], [']', 2]])), true))))), ']', false, ([, ns], rest) => [[(0, dom_1.html)('a', (0, dom_1.defrag)(ns))], rest])), ([el]) => [(0, dom_1.define)(el, {
   id: el.id ? null : global_1.undefined,
   class: 'index',
   href: el.id ? `#${el.id}` : global_1.undefined
@@ -6649,7 +6654,7 @@ exports.insertion = (0, combinator_1.lazy)(() => (0, combinator_1.surround)((0,
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.resolve = exports.option = exports.uri = exports.textlink = exports.link = void 0;
+exports.resolve = exports.option = exports.uri = exports.unsafelink = exports.link = void 0;
 
 const global_1 = __webpack_require__(4128);
 
@@ -6677,13 +6682,14 @@ const optspec = {
   rel: ['nofollow']
 };
 Object.setPrototypeOf(optspec, null);
-exports.link = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['[', '{'], (0, combinator_1.bind)((0, combinator_1.constraint)(4
+exports.link = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['[', '{'], (0, combinator_1.union)([medialink, textlink])));
+const textlink = (0, combinator_1.lazy)(() => (0, combinator_1.constraint)(4
 /* State.link */
-, false, (0, combinator_1.syntax)(256
-/* Syntax.link */
-, 2, 10, (0, combinator_1.fmap)((0, combinator_1.subsequence)([(0, combinator_1.state)(4
+, false, (0, combinator_1.state)(4
 /* State.link */
-, (0, combinator_1.dup)((0, combinator_1.union)([(0, combinator_1.surround)('[', inline_1.media, ']'), (0, combinator_1.surround)('[', inline_1.shortmedia, ']'), (0, combinator_1.surround)('[', (0, combinator_1.state)(64
+| 2
+/* State.media */
+| 64
 /* State.annotation */
 | 32
 /* State.reference */
@@ -6691,35 +6697,52 @@ exports.link = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['[', '{'
 /* State.index */
 | 8
 /* State.label */
-| 2
-/* State.media */
 | 1
 /* State.autolink */
-, (0, combinator_1.some)(inline_1.inline, ']', [[/^\\?\n/, 9], [']', 2]])), ']', true)]))), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))], nodes => nodes[0][0] !== ''), ([as, bs = []]) => bs[0] === '\r' && bs.shift() ? [as, bs] : as[0] === '\r' && as.shift() ? [[], as] : [as, []]))), ([content, params], rest, context) => {
-  if (content[0] === '') return [content, rest];
-  if (params.length === 0) return;
+, (0, combinator_1.syntax)(256
+/* Syntax.link */
+, 2, 10, (0, combinator_1.bind)((0, combinator_1.reverse)((0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([inline_1.inline]), ']', [[/^\\?\n/, 9], [']', 2]]), ']', true)), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))])), ([params, content = []], rest, context) => {
   if (content.length !== 0 && (0, visibility_1.trimNode)(content).length === 0) return;
 
   for (let source = (0, util_1.stringify)(content); source;) {
-    const result = (0, autolink_1.autolink)(source, context);
+    const result = (0, combinator_1.state)(1
+    /* State.autolink */
+    , false, autolink_1.autolink)(source, context);
     if (typeof (0, parser_1.eval)(result)[0] === 'object') return;
     source = (0, parser_1.exec)(result);
   }
 
+  return parse(content, params, rest, context);
+})))));
+const medialink = (0, combinator_1.lazy)(() => (0, combinator_1.constraint)(4
+/* State.link */
+| 2
+/* State.media */
+, false, (0, combinator_1.state)(4
+/* State.link */
+| 64
+/* State.annotation */
+| 32
+/* State.reference */
+| 16
+/* State.index */
+| 8
+/* State.label */
+| 1
+/* State.autolink */
+, (0, combinator_1.syntax)(256
+/* Syntax.link */
+, 2, 10, (0, combinator_1.bind)((0, combinator_1.reverse)((0, combinator_1.sequence)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.union)([inline_1.media, inline_1.shortmedia]), ']')), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))])), ([params, content = []], rest, context) => parse(content, params, rest, context))))));
+exports.unsafelink = (0, combinator_1.lazy)(() => (0, combinator_1.creation)(10, (0, combinator_1.precedence)(2, (0, combinator_1.bind)((0, combinator_1.reverse)((0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([source_1.unescsource]), ']'), ']')), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))])), ([params, content = []], rest, context) => parse(content, params, rest, context)))));
+exports.uri = (0, combinator_1.union)([(0, combinator_1.open)(/^[^\S\n]+/, (0, source_1.str)(/^\S+/)), (0, source_1.str)(/^[^\s{}]+/)]);
+exports.option = (0, combinator_1.union)([(0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+nofollow(?=[^\S\n]|})/), () => [` rel="nofollow"`]), (0, source_1.str)(/^[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|})/), (0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[^\s{}]+/), opt => [` \\${opt.slice(1)}`])]);
+
+function parse(content, params, rest, context) {
   const INSECURE_URI = params.shift();
   const el = elem(INSECURE_URI, (0, dom_1.defrag)(content), new url_1.ReadonlyURL(resolve(INSECURE_URI, context.host ?? global_1.location, context.url ?? context.host ?? global_1.location), context.host?.href || global_1.location.href), context.host?.origin || global_1.location.origin);
   if (el.className === 'invalid') return [[el], rest];
   return [[(0, dom_1.define)(el, (0, html_1.attributes)('link', [], optspec, params))], rest];
-})));
-exports.textlink = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['[', '{'], (0, combinator_1.bind)((0, combinator_1.creation)(10, (0, combinator_1.precedence)(2, (0, combinator_1.reverse)((0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([source_1.unescsource]), ']'), ']')), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))])))), ([params, content = []], rest, context) => {
-  params.shift();
-  (0, visibility_1.trimNode)(content);
-  const INSECURE_URI = params.shift();
-  const el = elem(INSECURE_URI, (0, dom_1.defrag)(content), new url_1.ReadonlyURL(resolve(INSECURE_URI, context.host ?? global_1.location, context.url ?? context.host ?? global_1.location), context.host?.href || global_1.location.href), context.host?.origin || global_1.location.origin);
-  return [[(0, dom_1.define)(el, (0, html_1.attributes)('link', [], optspec, params))], rest];
-})));
-exports.uri = (0, combinator_1.fmap)((0, combinator_1.union)([(0, combinator_1.open)(/^[^\S\n]+/, (0, source_1.str)(/^\S+/)), (0, source_1.str)(/^[^\s{}]+/)]), ([uri]) => ['\r', uri]);
-exports.option = (0, combinator_1.union)([(0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+nofollow(?=[^\S\n]|})/), () => [` rel="nofollow"`]), (0, source_1.str)(/^[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|})/), (0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[^\s{}]+/), opt => [` \\${opt.slice(1)}`])]);
+}
 
 function resolve(uri, host, source) {
   switch (true) {
@@ -6899,11 +6922,11 @@ const optspec = {
   rel: global_1.undefined
 };
 Object.setPrototypeOf(optspec, null);
-exports.media = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['![', '!{'], (0, combinator_1.bind)((0, combinator_1.verify)((0, combinator_1.fmap)((0, combinator_1.open)('!', (0, combinator_1.constraint)(2
+exports.media = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['![', '!{'], (0, combinator_1.open)('!', (0, combinator_1.constraint)(2
 /* State.media */
 , false, (0, combinator_1.syntax)(64
 /* Syntax.media */
-, 2, 10, (0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, bracket, source_1.txt]), ']', [[/^\\?\n/, 9]]), ']', true)), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([link_1.uri, (0, combinator_1.some)(option)]), /^[^\S\n]*}/))])))), ([as, bs]) => bs ? [[as.join('').trim() || as.join('')], (0, array_1.shift)(bs)[1]] : [[''], (0, array_1.shift)(as)[1]]), ([[text]]) => text === '' || text.trim() !== ''), ([[text], params], rest, context) => {
+, 2, 10, (0, combinator_1.bind)((0, combinator_1.verify)((0, combinator_1.fmap)((0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, bracket, source_1.txt]), ']', [[/^\\?\n/, 9]]), ']', true)), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([link_1.uri, (0, combinator_1.some)(option)]), /^[^\S\n]*}/))]), ([as, bs]) => bs ? [[as.join('').trim() || as.join('')], bs] : [[''], as]), ([[text]]) => text === '' || text.trim() !== ''), ([[text], params], rest, context) => {
   const INSECURE_URI = params.shift();
   const url = new url_1.ReadonlyURL((0, link_1.resolve)(INSECURE_URI, context.host ?? global_1.location, context.url ?? context.host ?? global_1.location), context.host?.href || global_1.location.href);
   let cache;
@@ -6923,11 +6946,12 @@ exports.media = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['![', '
 
   if (context.state & 4
   /* State.link */
-  || cache && cache.tagName !== 'IMG') return [[el], rest];
-  return (0, combinator_1.fmap)(link_1.textlink, ([link]) => [(0, dom_1.define)(link, {
+  ) return [[el], rest];
+  if (cache && cache.tagName !== 'IMG') return (0, combinator_1.creation)(10, (..._) => [[el], rest])('!', context);
+  return (0, combinator_1.fmap)(link_1.unsafelink, ([link]) => [(0, dom_1.define)(link, {
     target: '_blank'
   }, [el])])(`{ ${INSECURE_URI}${params.join('')} }${rest}`, context);
-})));
+}))))));
 const bracket = (0, combinator_1.lazy)(() => (0, combinator_1.creation)((0, combinator_1.union)([(0, combinator_1.surround)((0, source_1.str)('('), (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, bracket, source_1.txt]), ')'), (0, source_1.str)(')'), true, global_1.undefined, ([as, bs = []], rest) => [(0, array_1.unshift)(as, bs), rest]), (0, combinator_1.surround)((0, source_1.str)('['), (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, bracket, source_1.txt]), ']'), (0, source_1.str)(']'), true, global_1.undefined, ([as, bs = []], rest) => [(0, array_1.unshift)(as, bs), rest]), (0, combinator_1.surround)((0, source_1.str)('{'), (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, bracket, source_1.txt]), '}'), (0, source_1.str)('}'), true, global_1.undefined, ([as, bs = []], rest) => [(0, array_1.unshift)(as, bs), rest]), (0, combinator_1.surround)((0, source_1.str)('"'), (0, combinator_1.precedence)(8, (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, source_1.txt]), '"')), (0, source_1.str)('"'), true)])));
 const option = (0, combinator_1.union)([(0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[1-9][0-9]*x[1-9][0-9]*(?=[^\S\n]|})/), ([opt]) => [` width="${opt.slice(1).split('x')[0]}"`, ` height="${opt.slice(1).split('x')[1]}"`]), (0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[1-9][0-9]*:[1-9][0-9]*(?=[^\S\n]|})/), ([opt]) => [` aspect-ratio="${opt.slice(1).split(':').join('/')}"`]), link_1.option]);
 
@@ -7000,15 +7024,15 @@ const dom_1 = __webpack_require__(3252);
 
 exports.reference = (0, combinator_1.lazy)(() => (0, combinator_1.surround)('[[', (0, combinator_1.constraint)(32
 /* State.reference */
-, false, (0, combinator_1.syntax)(4096
-/* Syntax.reference */
-, 6, 1, (0, combinator_1.state)(64
+, false, (0, combinator_1.state)(64
 /* State.annotation */
 | 32
 /* State.reference */
 | 2
 /* State.media */
-, (0, visibility_1.startLoose)((0, combinator_1.context)({
+, (0, combinator_1.syntax)(4096
+/* Syntax.reference */
+, 6, 1, (0, visibility_1.startLoose)((0, combinator_1.context)({
   delimiters: global_1.undefined
 }, (0, combinator_1.subsequence)([abbr, (0, combinator_1.open)((0, source_1.stropt)(/^(?=\^)/), (0, combinator_1.some)(inline_1.inline, ']', [[/^\\?\n/, 9], [']', 2], [']]', 6]])), (0, combinator_1.some)(inline_1.inline, ']', [[/^\\?\n/, 9], [']', 2], [']]', 6]])])), ']')))), ']]', false, ([, ns], rest) => [[(0, dom_1.html)('sup', attributes(ns), [(0, dom_1.html)('span', (0, visibility_1.trimNode)((0, dom_1.defrag)(ns)))])], rest]));
 const abbr = (0, combinator_1.creation)((0, combinator_1.bind)((0, combinator_1.surround)('^', (0, combinator_1.union)([(0, source_1.str)(/^(?![0-9]+\s?[|\]])[0-9A-Za-z]+(?:(?:-|(?=\W)(?!'\d)'?(?!\.\d)\.?(?!,\S),? ?)[0-9A-Za-z]+)*(?:-|'?\.?,? ?)?/)]), /^\|?(?=]])|^\|[^\S\n]*/), ([source], rest) => [[(0, dom_1.html)('abbr', source)], rest.replace(visibility_1.regBlankStart, '')]));

package/markdown.d.ts

@@ -577,6 +577,7 @@ export namespace MarkdownParser {
             InlineParser.AutolinkParser.AnchorParser,
             Parser<HTMLAnchorElement, Context, []>,
             Parser<HTMLAnchorElement, Context, []>,
+            Parser<HTMLAnchorElement, Context, []>,
           ]>,
         ]> {
       }
@@ -660,7 +661,7 @@ export namespace MarkdownParser {
     export interface AnnotationParser extends
       // ((abc))
       Inline<'annotation'>,
-      Parser<HTMLElement | string, Context, [
+      Parser<HTMLElement, Context, [
         InlineParser,
       ]> {
     }
@@ -669,7 +670,7 @@ export namespace MarkdownParser {
       // [[^abbr]]
       // [[^abbr| abc]]
       Inline<'reference'>,
-      Parser<HTMLElement | string, Context, [
+      Parser<HTMLElement, Context, [
         ReferenceParser.AbbrParser,
         InlineParser,
         InlineParser,
@@ -689,7 +690,7 @@ export namespace MarkdownParser {
     export interface TemplateParser extends
       // {{abc}}
       Inline<'template'>,
-      Parser<HTMLSpanElement | string, Context, [
+      Parser<HTMLSpanElement, Context, [
         TemplateParser.BracketParser,
         SourceParser.EscapableSourceParser,
       ]> {
@@ -842,21 +843,38 @@ export namespace MarkdownParser {
       // { uri }
       // [abc]{uri nofollow}
       Inline<'link'>,
-      Parser<HTMLElement | string, Context, [
-        LinkParser.ContentParser,
-        LinkParser.ParameterParser,
-      ]> {
-    }
-    export interface TextLinkParser extends
-      // { uri }
-      // [abc]{uri nofollow}
-      Inline<'textlink'>,
       Parser<HTMLAnchorElement, Context, [
-        LinkParser.TextParser,
-        LinkParser.ParameterParser,
+        LinkParser.MediaLinkParser,
+        LinkParser.TextLinkParser,
       ]> {
     }
     export namespace LinkParser {
+      export interface TextLinkParser extends
+        Inline<'link/textlink'>,
+        Parser<HTMLAnchorElement, Context, [
+          Parser<(HTMLElement | string)[], Context, [
+            InlineParser,
+          ]>,
+          LinkParser.ParameterParser,
+        ]> {
+      }
+      export interface MediaLinkParser extends
+        Inline<'link/medialink'>,
+        Parser<HTMLAnchorElement, Context, [
+          Parser<HTMLElement[], Context, [
+            MediaParser,
+            ShortmediaParser,
+          ]>,
+          LinkParser.ParameterParser,
+        ]> {
+      }
+      export interface UnsafeLinkParser extends
+        Inline<'link/unsafelink'>,
+        Parser<HTMLAnchorElement, Context, [
+          LinkParser.TextParser,
+          LinkParser.ParameterParser,
+        ]> {
+      }
       export interface ContentParser extends
         Inline<'link/content'>,
         Parser<(HTMLElement | string)[], Context, [
@@ -1093,7 +1111,7 @@ export namespace MarkdownParser {
         // https://host
         Inline<'url'>,
         Parser<HTMLAnchorElement, Context, [
-          TextLinkParser,
+          LinkParser.UnsafeLinkParser,
         ]> {
       }
       export namespace UrlParser {
@@ -1135,28 +1153,28 @@ export namespace MarkdownParser {
         // @user
         Inline<'account'>,
         Parser<HTMLAnchorElement, Context, [
-          TextLinkParser,
+          LinkParser.UnsafeLinkParser,
         ]> {
       }
       export interface HashtagParser extends
         // #tag
         Inline<'hashtag'>,
         Parser<HTMLAnchorElement, Context, [
-          TextLinkParser,
+          LinkParser.UnsafeLinkParser,
         ]> {
       }
       export interface HashnumParser extends
         // #1
         Inline<'hashnum'>,
         Parser<HTMLAnchorElement, Context, [
-          TextLinkParser,
+          LinkParser.UnsafeLinkParser,
         ]> {
       }
       export interface AnchorParser extends
         // >>1
         Inline<'anchor'>,
         Parser<HTMLAnchorElement, Context, [
-          TextLinkParser,
+          LinkParser.UnsafeLinkParser,
         ]> {
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.258.7",
+  "version": "0.259.0",
   "description": "Secure markdown renderer working on browsers for user input data.",
   "private": false,
   "homepage": "https://github.com/falsandtru/securemark",

package/src/combinator/data/parser/context.ts

@@ -89,6 +89,7 @@ export function creation<P extends Parser<unknown>>(parser: P): P;
 export function creation<P extends Parser<unknown>>(cost: number, parser: P): P;
 export function creation(cost: number | Parser<unknown>, parser?: Parser<unknown>): Parser<unknown> {
   if (typeof cost === 'function') return creation(1, cost);
+  if (cost === 0) return parser!;
   assert(cost >= 0);
   return (source, context) => {
     const { resources = { clock: 1, recursion: 1 } } = context;

package/src/parser/block/reply/cite.test.ts

@@ -18,7 +18,7 @@ describe('Unit: parser/block/reply/cite', () => {
       assert.deepStrictEqual(inspect(parser('>>\\')), undefined);
       assert.deepStrictEqual(inspect(parser('>>01#')), undefined);
       assert.deepStrictEqual(inspect(parser('>>01@')), undefined);
-      assert.deepStrictEqual(inspect(parser('>>https://host')), undefined);
+      assert.deepStrictEqual(inspect(parser('>>http://')), undefined);
       assert.deepStrictEqual(inspect(parser('>>tel:1234567890')), undefined);
       assert.deepStrictEqual(inspect(parser('>>..')), undefined);
       assert.deepStrictEqual(inspect(parser('>> 0')), undefined);
@@ -43,6 +43,8 @@ describe('Unit: parser/block/reply/cite', () => {
       assert.deepStrictEqual(inspect(parser('>>#a')), [['<span class="cite">&gt;<a class="anchor" data-depth="1">&gt;#a</a></span>', '<br>'], '']);
       assert.deepStrictEqual(inspect(parser('>>#index:a')), [['<span class="cite">&gt;<a class="anchor" data-depth="1">&gt;#index:a</a></span>', '<br>'], '']);
       assert.deepStrictEqual(inspect(parser('>>#:~:text=a')), [['<span class="cite">&gt;<a class="anchor" data-depth="1">&gt;#:~:text=a</a></span>', '<br>'], '']);
+      assert.deepStrictEqual(inspect(parser('>>http://host')), [['<span class="cite">&gt;<a class="anchor" href="http://host" target="_blank" data-depth="1">&gt;http://host</a></span>', '<br>'], '']);
+      assert.deepStrictEqual(inspect(parser('>>https://host')), [['<span class="cite">&gt;<a class="anchor" href="https://host" target="_blank" data-depth="1">&gt;https://host</a></span>', '<br>'], '']);
     });
 
   });

package/src/parser/block/reply/cite.ts

@@ -14,6 +14,7 @@ export const cite: ReplyParser.CiteParser = creation(line(fmap(validate(
       // リンクの実装は後で検討
       focus(/^>>\.[^\S\n]*(?:$|\n)/, () => [[html('a', { class: 'anchor' }, '>>.')], '']),
       focus(/^>>#\S*[^\S\n]*(?:$|\n)/, source => [[html('a', { class: 'anchor' }, source)], '']),
+      focus(/^>>https?:\/\/\w\S*[^\S\n]*(?:$|\n)/, source => [[html('a', { class: 'anchor', href: source.slice(2).trimEnd(), target: '_blank' }, source)], '']),
     ]),
   ]))),
   ([el, quotes = '']: [HTMLElement, string?]) => [

package/src/parser/inline/annotation.ts

@@ -9,8 +9,8 @@ import { html, defrag } from 'typed-dom/dom';
 export const annotation: AnnotationParser = lazy(() => surround(
   '((',
   constraint(State.annotation, false,
-  syntax(Syntax.annotation, 6, 1,
   state(State.annotation | State.media,
+  syntax(Syntax.annotation, 6, 1,
   startLoose(
   context({ delimiters: undefined },
   some(union([inline]), ')', [[/^\\?\n/, 9], [')', 2], ['))', 6]])), ')')))),

package/src/parser/inline/autolink/account.ts

@@ -1,6 +1,6 @@
 import { AutolinkParser } from '../../inline';
 import { union, tails, verify, rewrite, open, convert, fmap, lazy } from '../../../combinator';
-import { textlink } from '../link';
+import { unsafelink } from '../link';
 import { str } from '../../source';
 import { define } from 'typed-dom/dom';
 
@@ -24,5 +24,5 @@ export const account: AutolinkParser.AccountParser = lazy(() => fmap(rewrite(
         ? `https://${source.slice(1).replace('/', '/@')}`
         : `/${source}`
       } }`,
-    union([textlink]))),
+    union([unsafelink]))),
   ([el]) => [define(el, { class: 'account' })]));

package/src/parser/inline/autolink/anchor.ts

@@ -1,6 +1,6 @@
 import { AutolinkParser } from '../../inline';
 import { union, validate, focus, convert, fmap, lazy } from '../../../combinator';
-import { textlink } from '../link';
+import { unsafelink } from '../link';
 import { define } from 'typed-dom/dom';
 
 // Timeline(pseudonym): user/tid
@@ -21,5 +21,5 @@ export const anchor: AutolinkParser.AnchorParser = lazy(() => validate('>>', fma
         ? `/@${source.slice(2).replace('/', '/timeline/')}`
         : `?at=${source.slice(2)}`
       } }`,
-    union([textlink]))),
+    union([unsafelink]))),
   ([el]) => [define(el, { class: 'anchor' })])));

package/src/parser/inline/autolink/hashnum.ts

@@ -1,6 +1,6 @@
 import { AutolinkParser } from '../../inline';
 import { union, rewrite, open, convert, fmap, lazy } from '../../../combinator';
-import { textlink } from '../link';
+import { unsafelink } from '../link';
 import { emoji } from './hashtag';
 import { str } from '../../source';
 import { define } from 'typed-dom/dom';
@@ -9,5 +9,5 @@ export const hashnum: AutolinkParser.HashnumParser = lazy(() => fmap(rewrite(
   open('#', str(new RegExp(/^[0-9]{1,16}(?![^\p{C}\p{S}\p{P}\s]|emoji|['_])/u.source.replace(/emoji/, emoji), 'u'))),
   convert(
     source => `[${source}]{ ${source.slice(1)} }`,
-    union([textlink]))),
+    union([unsafelink]))),
   ([el]) => [define(el, { class: 'hashnum', href: null })]));

package/src/parser/inline/autolink/hashtag.ts

@@ -1,6 +1,6 @@
 import { AutolinkParser } from '../../inline';
 import { union, tails, verify, rewrite, open, convert, fmap, lazy } from '../../../combinator';
-import { textlink } from '../link';
+import { unsafelink } from '../link';
 import { str } from '../../source';
 import { define } from 'typed-dom/dom';
 
@@ -31,5 +31,5 @@ export const hashtag: AutolinkParser.HashtagParser = lazy(() => fmap(rewrite(
         ? `https://${source.slice(1).replace('/', '/hashtags/')}`
         : `/hashtags/${source.slice(1)}`
       } }`,
-    union([textlink]))),
+    union([unsafelink]))),
   ([el]) => [define(el, { class: 'hashtag' }, el.innerText)]));

package/src/parser/inline/autolink/url.ts

@@ -1,6 +1,6 @@
 import { AutolinkParser } from '../../inline';
 import { union, some, creation, precedence, validate, focus, rewrite, convert, surround, open, lazy } from '../../../combinator';
-import { textlink } from '../link';
+import { unsafelink } from '../link';
 import { unescsource } from '../../source';
 
 const closer = /^[-+*=~^,.;:!?]*(?=[\\"`|\[\](){}<>]|$)/;
@@ -11,7 +11,7 @@ export const url: AutolinkParser.UrlParser = lazy(() => validate(['http://', 'ht
     focus(/^[\x21-\x7E]+/, some(union([bracket, some(unescsource, closer)])))),
   convert(
     url => `{ ${url} }`,
-    union([textlink])))));
+    union([unsafelink])))));
 
 const bracket: AutolinkParser.UrlParser.BracketParser = lazy(() => creation(precedence(2, union([
   surround('(', some(union([bracket, unescsource]), ')'), ')', true),

package/src/parser/inline/extension/index.ts

@@ -13,8 +13,8 @@ import IndexParser = ExtensionParser.IndexParser;
 export const index: IndexParser = lazy(() => validate('[#', fmap(indexee(surround(
   '[#',
   constraint(State.index, false,
-  syntax(Syntax.index, 2, 1,
   state(State.annotation | State.reference | State.index | State.label | State.link | State.media | State.autolink,
+  syntax(Syntax.index, 2, 1,
   startTight(
   open(stropt(/^\|?/), trimBlankEnd(some(union([
     signature,

package/src/parser/inline/link.ts

@@ -1,7 +1,8 @@
 import { undefined, location, encodeURI, decodeURI, Location } from 'spica/global';
-import { LinkParser, TextLinkParser } from '../inline';
-import { eval, exec } from '../../combinator/data/parser';
-import { union, inits, tails, subsequence, some, constraint, syntax, creation, precedence, state, validate, surround, open, dup, reverse, lazy, fmap, bind } from '../../combinator';
+import { MarkdownParser } from '../../../markdown';
+import { LinkParser } from '../inline';
+import { Result, eval, exec } from '../../combinator/data/parser';
+import { union, inits, tails, sequence, some, constraint, syntax, creation, precedence, state, validate, surround, open, dup, reverse, lazy, fmap, bind } from '../../combinator';
 import { inline, media, shortmedia } from '../inline';
 import { attributes } from './html';
 import { autolink } from '../autolink';
@@ -17,81 +18,64 @@ const optspec = {
 } as const;
 Object.setPrototypeOf(optspec, null);
 
-export const link: LinkParser = lazy(() => validate(['[', '{'], bind(
+export const link: LinkParser = lazy(() => validate(['[', '{'], union([
+  medialink,
+  textlink,
+])));
+
+const textlink: LinkParser.TextLinkParser = lazy(() =>
   constraint(State.link, false,
+  state(State.link | State.media | State.annotation | State.reference | State.index | State.label | State.autolink,
   syntax(Syntax.link, 2, 10,
-  fmap(subsequence([
-    state(State.link,
-    dup(union([
-      surround('[', media, ']'),
-      surround('[', shortmedia, ']'),
-      surround(
-        '[',
-        state(State.annotation | State.reference | State.index | State.label | State.media | State.autolink,
-        some(inline, ']', [[/^\\?\n/, 9], [']', 2]])),
-        ']',
-        true),
-    ]))),
+  bind(reverse(tails([
+    dup(surround(
+      '[',
+      some(union([inline]), ']', [[/^\\?\n/, 9], [']', 2]]),
+      ']',
+      true)),
     dup(surround(/^{(?![{}])/, inits([uri, some(option)]), /^[^\S\n]*}/)),
-  ], nodes => nodes[0][0] !== ''),
-  ([as, bs = []]) => bs[0] === '\r' && bs.shift() ? [as, bs] : as[0] === '\r' && as.shift() ? [[], as] : [as, []]))),
-  ([content, params]: [(HTMLElement | string)[], string[]], rest, context) => {
-    assert(content[0] !== '' || params.length === 0);
-    if (content[0] === '') return [content, rest];
-    if (params.length === 0) return;
-    assert(params.every(p => typeof p === 'string'));
+  ])),
+  ([params, content = []]: [string[], (HTMLElement | string)[]], rest, context) => {
+    assert(!html('div', content).querySelector('a, .media, .annotation, .reference'));
     if (content.length !== 0 && trimNode(content).length === 0) return;
     for (let source = stringify(content); source;) {
-      const result = autolink(source, context);
+      const result = state(State.autolink, false, autolink)(source, context);
       if (typeof eval(result!)[0] === 'object') return;
       source = exec(result!);
     }
-    assert(!html('div', content).querySelector('a, .media, .annotation, .reference') || (content[0] as HTMLElement).matches('.media'));
-    const INSECURE_URI = params.shift()!;
-    assert(INSECURE_URI === INSECURE_URI.trim());
-    assert(!INSECURE_URI.match(/\s/));
-    const el = elem(
-      INSECURE_URI,
-      defrag(content),
-      new ReadonlyURL(
-        resolve(INSECURE_URI, context.host ?? location, context.url ?? context.host ?? location),
-        context.host?.href || location.href),
-      context.host?.origin || location.origin);
-    if (el.className === 'invalid') return [[el], rest];
-    assert(el.classList.length === 0);
-    return [[define(el, attributes('link', [], optspec, params))], rest];
-  })));
+    return parse(content, params, rest, context);
+  })))));
+
+const medialink: LinkParser.MediaLinkParser = lazy(() =>
+  constraint(State.link | State.media, false,
+  state(State.link | State.annotation | State.reference | State.index | State.label | State.autolink,
+  syntax(Syntax.link, 2, 10,
+  bind(reverse(sequence([
+    dup(surround(
+      '[',
+      union([media, shortmedia]),
+      ']')),
+    dup(surround(/^{(?![{}])/, inits([uri, some(option)]), /^[^\S\n]*}/)),
+  ])),
+  ([params, content = []]: [string[], (HTMLElement | string)[]], rest, context) =>
+    parse(content, params, rest, context))))));
 
-export const textlink: TextLinkParser = lazy(() => validate(['[', '{'], bind(
+export const unsafelink: LinkParser.UnsafeLinkParser = lazy(() =>
   creation(10, precedence(2,
-  reverse(tails([
-    dup(surround('[', some(union([unescsource]), ']'), ']')),
+  bind(reverse(tails([
+    dup(surround(
+      '[',
+      some(union([unescsource]), ']'),
+      ']')),
     dup(surround(/^{(?![{}])/, inits([uri, some(option)]), /^[^\S\n]*}/)),
-  ])))),
-  ([params, content = []], rest, context) => {
-    assert(params[0] === '\r');
-    params.shift();
-    assert(params.every(p => typeof p === 'string'));
-    trimNode(content);
-    const INSECURE_URI = params.shift()!;
-    assert(INSECURE_URI === INSECURE_URI.trim());
-    assert(!INSECURE_URI.match(/\s/));
-    const el = elem(
-      INSECURE_URI,
-      defrag(content),
-      new ReadonlyURL(
-        resolve(INSECURE_URI, context.host ?? location, context.url ?? context.host ?? location),
-        context.host?.href || location.href),
-      context.host?.origin || location.origin);
-    assert(el.className !== 'invalid');
-    assert(el.classList.length === 0);
-    return [[define(el, attributes('link', [], optspec, params))], rest];
-  })));
+  ])),
+  ([params, content = []], rest, context) =>
+    parse(content, params, rest, context)))));
 
-export const uri: LinkParser.ParameterParser.UriParser = fmap(union([
+export const uri: LinkParser.ParameterParser.UriParser = union([
   open(/^[^\S\n]+/, str(/^\S+/)),
   str(/^[^\s{}]+/),
-]), ([uri]) => ['\r', uri]);
+]);
 
 export const option: LinkParser.ParameterParser.OptionParser = union([
   fmap(str(/^[^\S\n]+nofollow(?=[^\S\n]|})/), () => [` rel="nofollow"`]),
@@ -99,6 +83,29 @@ export const option: LinkParser.ParameterParser.OptionParser = union([
   fmap(str(/^[^\S\n]+[^\s{}]+/), opt => [` \\${opt.slice(1)}`]),
 ]);
 
+function parse(
+  content: (string | HTMLElement)[],
+  params: string[],
+  rest: string,
+  context: MarkdownParser.Context,
+): Result<HTMLAnchorElement, MarkdownParser.Context> {
+  assert(params.length > 0);
+  assert(params.every(p => typeof p === 'string'));
+  const INSECURE_URI = params.shift()!;
+  assert(INSECURE_URI === INSECURE_URI.trim());
+  assert(!INSECURE_URI.match(/\s/));
+  const el = elem(
+    INSECURE_URI,
+    defrag(content),
+    new ReadonlyURL(
+      resolve(INSECURE_URI, context.host ?? location, context.url ?? context.host ?? location),
+      context.host?.href || location.href),
+    context.host?.origin || location.origin);
+  if (el.className === 'invalid') return [[el], rest];
+  assert(el.classList.length === 0);
+  return [[define(el, attributes('link', [], optspec, params))], rest];
+}
+
 export function resolve(uri: string, host: URL | Location, source: URL | Location): string {
   assert(uri);
   assert(uri === uri.trim());

package/src/parser/inline/media.ts

@@ -1,14 +1,14 @@
 import { undefined, location } from 'spica/global';
 import { MediaParser } from '../inline';
 import { union, inits, tails, some, syntax, creation, precedence, constraint, validate, verify, surround, open, dup, lazy, fmap, bind } from '../../combinator';
-import { textlink, uri, option as linkoption, resolve } from './link';
+import { unsafelink, uri, option as linkoption, resolve } from './link';
 import { attributes } from './html';
 import { unsafehtmlentity } from './htmlentity';
 import { txt, str } from '../source';
 import { Syntax, State } from '../context';
 import { html, define } from 'typed-dom/dom';
 import { ReadonlyURL } from 'spica/url';
-import { unshift, shift, push } from 'spica/array';
+import { unshift, push } from 'spica/array';
 
 const optspec = {
   'width': [],
@@ -18,19 +18,19 @@ const optspec = {
 } as const;
 Object.setPrototypeOf(optspec, null);
 
-export const media: MediaParser = lazy(() => validate(['![', '!{'], bind(verify(fmap(open(
+export const media: MediaParser = lazy(() => validate(['![', '!{'], open(
   '!',
   constraint(State.media, false,
   syntax(Syntax.media, 2, 10,
-  tails([
+  bind(verify(fmap(tails([
     dup(surround(
       '[',
       some(union([unsafehtmlentity, bracket, txt]), ']', [[/^\\?\n/, 9]]),
       ']',
       true)),
     dup(surround(/^{(?![{}])/, inits([uri, some(option)]), /^[^\S\n]*}/)),
-  ])))),
-  ([as, bs]) => bs ? [[as.join('').trim() || as.join('')], shift(bs)[1]] : [[''], shift(as)[1]]),
+  ]),
+  ([as, bs]) => bs ? [[as.join('').trim() || as.join('')], bs] : [[''], as]),
   ([[text]]) => text === '' || text.trim() !== ''),
   ([[text], params], rest, context) => {
     assert(text === text.trim());
@@ -54,12 +54,13 @@ export const media: MediaParser = lazy(() => validate(['![', '!{'], bind(verify(
     if (el.hasAttribute('aspect-ratio')) {
       el.style.aspectRatio = el.getAttribute('aspect-ratio')!;
     }
-    if (context.state! & State.link || cache && cache.tagName !== 'IMG') return [[el], rest];
+    if (context.state! & State.link) return [[el], rest];
+    if (cache && cache.tagName !== 'IMG') return creation(10, (..._) => [[el!], rest])('!', context);
     return fmap(
-      textlink as MediaParser,
+      unsafelink as MediaParser,
       ([link]) => [define(link, { target: '_blank' }, [el])])
       (`{ ${INSECURE_URI}${params.join('')} }${rest}`, context);
-  })));
+  }))))));
 
 const bracket: MediaParser.TextParser.BracketParser = lazy(() => creation(union([
   surround(str('('), some(union([unsafehtmlentity, bracket, txt]), ')'), str(')'), true, undefined, ([as, bs = []], rest) => [unshift(as, bs), rest]),

package/src/parser/inline/reference.ts

@@ -11,8 +11,8 @@ import { html, defrag } from 'typed-dom/dom';
 export const reference: ReferenceParser = lazy(() => surround(
   '[[',
   constraint(State.reference, false,
-  syntax(Syntax.reference, 6, 1,
   state(State.annotation | State.reference | State.media,
+  syntax(Syntax.reference, 6, 1,
   startLoose(
   context({ delimiters: undefined },
   subsequence([

package/src/parser/inline.ts

@@ -34,7 +34,6 @@ export import MathParser = InlineParser.MathParser;
 export import ExtensionParser = InlineParser.ExtensionParser;
 export import RubyParser = InlineParser.RubyParser;
 export import LinkParser = InlineParser.LinkParser;
-export import TextLinkParser = InlineParser.TextLinkParser;
 export import HTMLParser = InlineParser.HTMLParser;
 export import InsertionParser = InlineParser.InsertionParser;
 export import DeletionParser = InlineParser.DeletionParser;