securemark 0.258.8 → 0.258.9

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.258.9
+
+- Refactoring.
+
 ## 0.258.8
 
 - Refactoring.

package/dist/index.js

@@ -1,4 +1,4 @@
-/*! securemark v0.258.8 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED License */
+/*! securemark v0.258.9 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED License */
 (function webpackUniversalModuleDefinition(root, factory) {
 	if(typeof exports === 'object' && typeof module === 'object')
 		module.exports = factory(require("DOMPurify"), require("Prism"));
@@ -5778,7 +5778,7 @@ const source_1 = __webpack_require__(6743);
 const dom_1 = __webpack_require__(3252); // https://example/@user must be a user page or a redirect page going there.
 
 
-exports.account = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('@', (0, combinator_1.tails)([(0, combinator_1.verify)((0, source_1.str)(/^[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?)*\//), ([source]) => source.length <= 253 + 1), (0, combinator_1.verify)((0, source_1.str)(/^[A-Za-z][0-9A-Za-z]*(?:-[0-9A-Za-z]+)*/), ([source]) => source.length <= 64)])), (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `https://${source.slice(1).replace('/', '/@')}` : `/${source}`} }`, (0, combinator_1.union)([link_1.textlink]))), ([el]) => [(0, dom_1.define)(el, {
+exports.account = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('@', (0, combinator_1.tails)([(0, combinator_1.verify)((0, source_1.str)(/^[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?)*\//), ([source]) => source.length <= 253 + 1), (0, combinator_1.verify)((0, source_1.str)(/^[A-Za-z][0-9A-Za-z]*(?:-[0-9A-Za-z]+)*/), ([source]) => source.length <= 64)])), (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `https://${source.slice(1).replace('/', '/@')}` : `/${source}`} }`, (0, combinator_1.union)([link_1.unsafelink]))), ([el]) => [(0, dom_1.define)(el, {
   class: 'account'
 })]));
 
@@ -5807,7 +5807,7 @@ const dom_1 = __webpack_require__(3252); // Timeline(pseudonym): user/tid
 // 外部表現は投稿ごとに投稿者の投稿時のタイムゾーンに統一する(非時系列順)
 
 
-exports.anchor = (0, combinator_1.lazy)(() => (0, combinator_1.validate)('>>', (0, combinator_1.fmap)((0, combinator_1.focus)(/^>>(?:[A-Za-z][0-9A-Za-z]*(?:-[0-9A-Za-z]+)*\/)?[0-9A-Za-z]+(?:-[0-9A-Za-z]+)*(?![0-9A-Za-z@#:])/, (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `/@${source.slice(2).replace('/', '/timeline/')}` : `?at=${source.slice(2)}`} }`, (0, combinator_1.union)([link_1.textlink]))), ([el]) => [(0, dom_1.define)(el, {
+exports.anchor = (0, combinator_1.lazy)(() => (0, combinator_1.validate)('>>', (0, combinator_1.fmap)((0, combinator_1.focus)(/^>>(?:[A-Za-z][0-9A-Za-z]*(?:-[0-9A-Za-z]+)*\/)?[0-9A-Za-z]+(?:-[0-9A-Za-z]+)*(?![0-9A-Za-z@#:])/, (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `/@${source.slice(2).replace('/', '/timeline/')}` : `?at=${source.slice(2)}`} }`, (0, combinator_1.union)([link_1.unsafelink]))), ([el]) => [(0, dom_1.define)(el, {
   class: 'anchor'
 })])));
 
@@ -5894,7 +5894,7 @@ const source_1 = __webpack_require__(6743);
 
 const dom_1 = __webpack_require__(3252);
 
-exports.hashnum = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('#', (0, source_1.str)(new RegExp(/^[0-9]{1,16}(?![^\p{C}\p{S}\p{P}\s]|emoji|['_])/u.source.replace(/emoji/, hashtag_1.emoji), 'u'))), (0, combinator_1.convert)(source => `[${source}]{ ${source.slice(1)} }`, (0, combinator_1.union)([link_1.textlink]))), ([el]) => [(0, dom_1.define)(el, {
+exports.hashnum = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('#', (0, source_1.str)(new RegExp(/^[0-9]{1,16}(?![^\p{C}\p{S}\p{P}\s]|emoji|['_])/u.source.replace(/emoji/, hashtag_1.emoji), 'u'))), (0, combinator_1.convert)(source => `[${source}]{ ${source.slice(1)} }`, (0, combinator_1.union)([link_1.unsafelink]))), ([el]) => [(0, dom_1.define)(el, {
   class: 'hashnum',
   href: null
 })]));
@@ -5923,7 +5923,7 @@ const dom_1 = __webpack_require__(3252); // https://example/hashtags/a must be a
 
 
 exports.emoji = String.raw`\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation}|\p{Emoji}\uFE0F`;
-exports.hashtag = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('#', (0, combinator_1.tails)([(0, combinator_1.verify)((0, source_1.str)(/^[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?)*\//), ([source]) => source.length <= 253 + 1), (0, combinator_1.verify)((0, source_1.str)(new RegExp([/^(?=[0-9]{0,127}_?(?:[^\d\p{C}\p{S}\p{P}\s]|emoji))/u.source, /(?:[^\p{C}\p{S}\p{P}\s]|emoji|_(?=[^\p{C}\p{S}\p{P}\s]|emoji)){1,128}/u.source, /(?!_?(?:[^\p{C}\p{S}\p{P}\s]|emoji)|')/u.source].join('').replace(/emoji/g, exports.emoji), 'u')), ([source]) => source.length <= 128)])), (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `https://${source.slice(1).replace('/', '/hashtags/')}` : `/hashtags/${source.slice(1)}`} }`, (0, combinator_1.union)([link_1.textlink]))), ([el]) => [(0, dom_1.define)(el, {
+exports.hashtag = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.rewrite)((0, combinator_1.open)('#', (0, combinator_1.tails)([(0, combinator_1.verify)((0, source_1.str)(/^[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-(?=\w)){0,61}[0-9A-Za-z])?)*\//), ([source]) => source.length <= 253 + 1), (0, combinator_1.verify)((0, source_1.str)(new RegExp([/^(?=[0-9]{0,127}_?(?:[^\d\p{C}\p{S}\p{P}\s]|emoji))/u.source, /(?:[^\p{C}\p{S}\p{P}\s]|emoji|_(?=[^\p{C}\p{S}\p{P}\s]|emoji)){1,128}/u.source, /(?!_?(?:[^\p{C}\p{S}\p{P}\s]|emoji)|')/u.source].join('').replace(/emoji/g, exports.emoji), 'u')), ([source]) => source.length <= 128)])), (0, combinator_1.convert)(source => `[${source}]{ ${source.includes('/') ? `https://${source.slice(1).replace('/', '/hashtags/')}` : `/hashtags/${source.slice(1)}`} }`, (0, combinator_1.union)([link_1.unsafelink]))), ([el]) => [(0, dom_1.define)(el, {
   class: 'hashtag'
 }, el.innerText)]));
 
@@ -5947,7 +5947,7 @@ const link_1 = __webpack_require__(9628);
 const source_1 = __webpack_require__(6743);
 
 const closer = /^[-+*=~^,.;:!?]*(?=[\\"`|\[\](){}<>]|$)/;
-exports.url = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['http://', 'https://'], (0, combinator_1.rewrite)((0, combinator_1.open)(/^https?:\/\/(?=[\x21-\x7E])/, (0, combinator_1.focus)(/^[\x21-\x7E]+/, (0, combinator_1.some)((0, combinator_1.union)([bracket, (0, combinator_1.some)(source_1.unescsource, closer)])))), (0, combinator_1.convert)(url => `{ ${url} }`, (0, combinator_1.union)([link_1.textlink])))));
+exports.url = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['http://', 'https://'], (0, combinator_1.rewrite)((0, combinator_1.open)(/^https?:\/\/(?=[\x21-\x7E])/, (0, combinator_1.focus)(/^[\x21-\x7E]+/, (0, combinator_1.some)((0, combinator_1.union)([bracket, (0, combinator_1.some)(source_1.unescsource, closer)])))), (0, combinator_1.convert)(url => `{ ${url} }`, (0, combinator_1.union)([link_1.unsafelink])))));
 const bracket = (0, combinator_1.lazy)(() => (0, combinator_1.creation)((0, combinator_1.precedence)(2, (0, combinator_1.union)([(0, combinator_1.surround)('(', (0, combinator_1.some)((0, combinator_1.union)([bracket, source_1.unescsource]), ')'), ')', true), (0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([bracket, source_1.unescsource]), ']'), ']', true), (0, combinator_1.surround)('{', (0, combinator_1.some)((0, combinator_1.union)([bracket, source_1.unescsource]), '}'), '}', true), (0, combinator_1.surround)('"', (0, combinator_1.precedence)(8, (0, combinator_1.some)(source_1.unescsource, '"')), '"', true)]))));
 
 /***/ }),
@@ -6650,7 +6650,7 @@ exports.insertion = (0, combinator_1.lazy)(() => (0, combinator_1.surround)((0,
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.resolve = exports.option = exports.uri = exports.textlink = exports.link = void 0;
+exports.resolve = exports.option = exports.uri = exports.unsafelink = exports.link = void 0;
 
 const global_1 = __webpack_require__(4128);
 
@@ -6678,11 +6678,14 @@ const optspec = {
   rel: ['nofollow']
 };
 Object.setPrototypeOf(optspec, null);
-exports.link = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['[', '{'], (0, combinator_1.bind)((0, combinator_1.constraint)(4
+exports.link = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['[', '{'], (0, combinator_1.union)([medialink, textlink])));
+const textlink = (0, combinator_1.lazy)(() => (0, combinator_1.constraint)(4
 /* State.link */
-, false, (0, combinator_1.creation)(10, (0, combinator_1.fmap)((0, combinator_1.subsequence)([(0, combinator_1.state)(4
+, false, (0, combinator_1.state)(4
 /* State.link */
-, (0, combinator_1.dup)((0, combinator_1.union)([(0, combinator_1.surround)('[', inline_1.media, ']'), (0, combinator_1.surround)('[', inline_1.shortmedia, ']'), (0, combinator_1.surround)('[', (0, combinator_1.state)(64
+| 2
+/* State.media */
+| 64
 /* State.annotation */
 | 32
 /* State.reference */
@@ -6690,37 +6693,56 @@ exports.link = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['[', '{'
 /* State.index */
 | 8
 /* State.label */
-| 2
-/* State.media */
 | 1
 /* State.autolink */
 , (0, combinator_1.syntax)(256
 /* Syntax.link */
-, 2, 0, (0, combinator_1.some)(inline_1.inline, ']', [[/^\\?\n/, 9], [']', 2]]))), ']', true)]))), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))], nodes => nodes[0][0] !== ''), ([as, bs = []]) => bs[0] === '\r' && bs.shift() ? [as, bs] : as[0] === '\r' && as.shift() ? [[], as] : [as, []]))), ([content, params], rest, context) => {
-  if (content[0] === '') return [content, rest];
-  if (params.length === 0) return;
+, 2, 10, (0, combinator_1.bind)((0, combinator_1.reverse)((0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([inline_1.inline]), ']', [[/^\\?\n/, 9], [']', 2]]), ']', true)), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))])), ([params, content = []], rest, context) => {
   if (content.length !== 0 && (0, visibility_1.trimNode)(content).length === 0) return;
 
   for (let source = (0, util_1.stringify)(content); source;) {
-    const result = (0, autolink_1.autolink)(source, context);
+    const result = (0, combinator_1.state)(1
+    /* State.autolink */
+    , false, autolink_1.autolink)(source, context);
     if (typeof (0, parser_1.eval)(result)[0] === 'object') return;
     source = (0, parser_1.exec)(result);
   }
 
-  const INSECURE_URI = params.shift();
-  const el = elem(INSECURE_URI, (0, dom_1.defrag)(content), new url_1.ReadonlyURL(resolve(INSECURE_URI, context.host ?? global_1.location, context.url ?? context.host ?? global_1.location), context.host?.href || global_1.location.href), context.host?.origin || global_1.location.origin);
-  if (el.className === 'invalid') return [[el], rest];
-  return [[(0, dom_1.define)(el, (0, html_1.attributes)('link', [], optspec, params))], rest];
+  return parse(content, params, rest, context);
+})))));
+const medialink = (0, combinator_1.lazy)(() => (0, combinator_1.constraint)(4
+/* State.link */
+| 2
+/* State.media */
+, false, (0, combinator_1.state)(4
+/* State.link */
+| 64
+/* State.annotation */
+| 32
+/* State.reference */
+| 16
+/* State.index */
+| 8
+/* State.label */
+| 1
+/* State.autolink */
+, (0, combinator_1.syntax)(256
+/* Syntax.link */
+, 2, 10, (0, combinator_1.bind)((0, combinator_1.reverse)((0, combinator_1.sequence)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.union)([inline_1.media, inline_1.shortmedia]), ']')), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))])), ([params, content = []], rest, context) => {
+  return parse(content, params, rest, context);
+})))));
+exports.unsafelink = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['[', '{'], (0, combinator_1.bind)((0, combinator_1.creation)(10, (0, combinator_1.precedence)(2, (0, combinator_1.reverse)((0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([source_1.unescsource]), ']'), ']')), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))])))), ([params, content = []], rest, context) => {
+  return parse(content, params, rest, context);
 })));
-exports.textlink = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['[', '{'], (0, combinator_1.bind)((0, combinator_1.creation)(10, (0, combinator_1.precedence)(2, (0, combinator_1.reverse)((0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([source_1.unescsource]), ']'), ']')), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))])))), ([params, content = []], rest, context) => {
-  params.shift();
-  (0, visibility_1.trimNode)(content);
+exports.uri = (0, combinator_1.union)([(0, combinator_1.open)(/^[^\S\n]+/, (0, source_1.str)(/^\S+/)), (0, source_1.str)(/^[^\s{}]+/)]);
+exports.option = (0, combinator_1.union)([(0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+nofollow(?=[^\S\n]|})/), () => [` rel="nofollow"`]), (0, source_1.str)(/^[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|})/), (0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[^\s{}]+/), opt => [` \\${opt.slice(1)}`])]);
+
+function parse(content, params, rest, context) {
   const INSECURE_URI = params.shift();
   const el = elem(INSECURE_URI, (0, dom_1.defrag)(content), new url_1.ReadonlyURL(resolve(INSECURE_URI, context.host ?? global_1.location, context.url ?? context.host ?? global_1.location), context.host?.href || global_1.location.href), context.host?.origin || global_1.location.origin);
+  if (el.className === 'invalid') return [[el], rest];
   return [[(0, dom_1.define)(el, (0, html_1.attributes)('link', [], optspec, params))], rest];
-})));
-exports.uri = (0, combinator_1.fmap)((0, combinator_1.union)([(0, combinator_1.open)(/^[^\S\n]+/, (0, source_1.str)(/^\S+/)), (0, source_1.str)(/^[^\s{}]+/)]), ([uri]) => ['\r', uri]);
-exports.option = (0, combinator_1.union)([(0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+nofollow(?=[^\S\n]|})/), () => [` rel="nofollow"`]), (0, source_1.str)(/^[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|})/), (0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[^\s{}]+/), opt => [` \\${opt.slice(1)}`])]);
+}
 
 function resolve(uri, host, source) {
   switch (true) {
@@ -6900,11 +6922,11 @@ const optspec = {
   rel: global_1.undefined
 };
 Object.setPrototypeOf(optspec, null);
-exports.media = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['![', '!{'], (0, combinator_1.bind)((0, combinator_1.verify)((0, combinator_1.fmap)((0, combinator_1.open)('!', (0, combinator_1.constraint)(2
+exports.media = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['![', '!{'], (0, combinator_1.open)('!', (0, combinator_1.constraint)(2
 /* State.media */
 , false, (0, combinator_1.syntax)(64
 /* Syntax.media */
-, 2, 10, (0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, bracket, source_1.txt]), ']', [[/^\\?\n/, 9]]), ']', true)), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([link_1.uri, (0, combinator_1.some)(option)]), /^[^\S\n]*}/))])))), ([as, bs]) => bs ? [[as.join('').trim() || as.join('')], (0, array_1.shift)(bs)[1]] : [[''], (0, array_1.shift)(as)[1]]), ([[text]]) => text === '' || text.trim() !== ''), ([[text], params], rest, context) => {
+, 2, 10, (0, combinator_1.bind)((0, combinator_1.verify)((0, combinator_1.fmap)((0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, bracket, source_1.txt]), ']', [[/^\\?\n/, 9]]), ']', true)), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([link_1.uri, (0, combinator_1.some)(option)]), /^[^\S\n]*}/))]), ([as, bs]) => bs ? [[as.join('').trim() || as.join('')], bs] : [[''], as]), ([[text]]) => text === '' || text.trim() !== ''), ([[text], params], rest, context) => {
   const INSECURE_URI = params.shift();
   const url = new url_1.ReadonlyURL((0, link_1.resolve)(INSECURE_URI, context.host ?? global_1.location, context.url ?? context.host ?? global_1.location), context.host?.href || global_1.location.href);
   let cache;
@@ -6924,11 +6946,12 @@ exports.media = (0, combinator_1.lazy)(() => (0, combinator_1.validate)(['![', '
 
   if (context.state & 4
   /* State.link */
-  || cache && cache.tagName !== 'IMG') return [[el], rest];
-  return (0, combinator_1.fmap)(link_1.textlink, ([link]) => [(0, dom_1.define)(link, {
+  ) return [[el], rest];
+  if (cache && cache.tagName !== 'IMG') return (0, combinator_1.creation)(10, (..._) => [[el], rest])('!', context);
+  return (0, combinator_1.fmap)(link_1.unsafelink, ([link]) => [(0, dom_1.define)(link, {
     target: '_blank'
   }, [el])])(`{ ${INSECURE_URI}${params.join('')} }${rest}`, context);
-})));
+}))))));
 const bracket = (0, combinator_1.lazy)(() => (0, combinator_1.creation)((0, combinator_1.union)([(0, combinator_1.surround)((0, source_1.str)('('), (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, bracket, source_1.txt]), ')'), (0, source_1.str)(')'), true, global_1.undefined, ([as, bs = []], rest) => [(0, array_1.unshift)(as, bs), rest]), (0, combinator_1.surround)((0, source_1.str)('['), (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, bracket, source_1.txt]), ']'), (0, source_1.str)(']'), true, global_1.undefined, ([as, bs = []], rest) => [(0, array_1.unshift)(as, bs), rest]), (0, combinator_1.surround)((0, source_1.str)('{'), (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, bracket, source_1.txt]), '}'), (0, source_1.str)('}'), true, global_1.undefined, ([as, bs = []], rest) => [(0, array_1.unshift)(as, bs), rest]), (0, combinator_1.surround)((0, source_1.str)('"'), (0, combinator_1.precedence)(8, (0, combinator_1.some)((0, combinator_1.union)([htmlentity_1.unsafehtmlentity, source_1.txt]), '"')), (0, source_1.str)('"'), true)])));
 const option = (0, combinator_1.union)([(0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[1-9][0-9]*x[1-9][0-9]*(?=[^\S\n]|})/), ([opt]) => [` width="${opt.slice(1).split('x')[0]}"`, ` height="${opt.slice(1).split('x')[1]}"`]), (0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[1-9][0-9]*:[1-9][0-9]*(?=[^\S\n]|})/), ([opt]) => [` aspect-ratio="${opt.slice(1).split(':').join('/')}"`]), link_1.option]);
 

package/markdown.d.ts

@@ -660,7 +660,7 @@ export namespace MarkdownParser {
     export interface AnnotationParser extends
       // ((abc))
       Inline<'annotation'>,
-      Parser<HTMLElement | string, Context, [
+      Parser<HTMLElement, Context, [
         InlineParser,
       ]> {
     }
@@ -669,7 +669,7 @@ export namespace MarkdownParser {
       // [[^abbr]]
       // [[^abbr| abc]]
       Inline<'reference'>,
-      Parser<HTMLElement | string, Context, [
+      Parser<HTMLElement, Context, [
         ReferenceParser.AbbrParser,
         InlineParser,
         InlineParser,
@@ -689,7 +689,7 @@ export namespace MarkdownParser {
     export interface TemplateParser extends
       // {{abc}}
       Inline<'template'>,
-      Parser<HTMLSpanElement | string, Context, [
+      Parser<HTMLSpanElement, Context, [
         TemplateParser.BracketParser,
         SourceParser.EscapableSourceParser,
       ]> {
@@ -842,21 +842,38 @@ export namespace MarkdownParser {
       // { uri }
       // [abc]{uri nofollow}
       Inline<'link'>,
-      Parser<HTMLElement | string, Context, [
-        LinkParser.ContentParser,
-        LinkParser.ParameterParser,
-      ]> {
-    }
-    export interface TextLinkParser extends
-      // { uri }
-      // [abc]{uri nofollow}
-      Inline<'textlink'>,
-      Parser<HTMLAnchorElement, Context, [
-        LinkParser.TextParser,
-        LinkParser.ParameterParser,
+      Parser<HTMLElement, Context, [
+        LinkParser.MediaLinkParser,
+        LinkParser.TextLinkParser,
       ]> {
     }
     export namespace LinkParser {
+      export interface TextLinkParser extends
+        Inline<'link/textlink'>,
+        Parser<HTMLElement, Context, [
+          Parser<(HTMLElement | string)[], Context, [
+            InlineParser,
+          ]>,
+          LinkParser.ParameterParser,
+        ]> {
+      }
+      export interface MediaLinkParser extends
+        Inline<'link/medialink'>,
+        Parser<HTMLElement, Context, [
+          Parser<HTMLElement[], Context, [
+            MediaParser,
+            ShortmediaParser,
+          ]>,
+          LinkParser.ParameterParser,
+        ]> {
+      }
+      export interface UnsafeLinkParser extends
+        Inline<'link/unsafelink'>,
+        Parser<HTMLAnchorElement, Context, [
+          LinkParser.TextParser,
+          LinkParser.ParameterParser,
+        ]> {
+      }
       export interface ContentParser extends
         Inline<'link/content'>,
         Parser<(HTMLElement | string)[], Context, [
@@ -1093,7 +1110,7 @@ export namespace MarkdownParser {
         // https://host
         Inline<'url'>,
         Parser<HTMLAnchorElement, Context, [
-          TextLinkParser,
+          LinkParser.UnsafeLinkParser,
         ]> {
       }
       export namespace UrlParser {
@@ -1135,28 +1152,28 @@ export namespace MarkdownParser {
         // @user
         Inline<'account'>,
         Parser<HTMLAnchorElement, Context, [
-          TextLinkParser,
+          LinkParser.UnsafeLinkParser,
         ]> {
       }
       export interface HashtagParser extends
         // #tag
         Inline<'hashtag'>,
         Parser<HTMLAnchorElement, Context, [
-          TextLinkParser,
+          LinkParser.UnsafeLinkParser,
         ]> {
       }
       export interface HashnumParser extends
         // #1
         Inline<'hashnum'>,
         Parser<HTMLAnchorElement, Context, [
-          TextLinkParser,
+          LinkParser.UnsafeLinkParser,
         ]> {
       }
       export interface AnchorParser extends
         // >>1
         Inline<'anchor'>,
         Parser<HTMLAnchorElement, Context, [
-          TextLinkParser,
+          LinkParser.UnsafeLinkParser,
         ]> {
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.258.8",
+  "version": "0.258.9",
   "description": "Secure markdown renderer working on browsers for user input data.",
   "private": false,
   "homepage": "https://github.com/falsandtru/securemark",

package/src/parser/inline/autolink/account.ts

@@ -1,6 +1,6 @@
 import { AutolinkParser } from '../../inline';
 import { union, tails, verify, rewrite, open, convert, fmap, lazy } from '../../../combinator';
-import { textlink } from '../link';
+import { unsafelink } from '../link';
 import { str } from '../../source';
 import { define } from 'typed-dom/dom';
 
@@ -24,5 +24,5 @@ export const account: AutolinkParser.AccountParser = lazy(() => fmap(rewrite(
         ? `https://${source.slice(1).replace('/', '/@')}`
         : `/${source}`
       } }`,
-    union([textlink]))),
+    union([unsafelink]))),
   ([el]) => [define(el, { class: 'account' })]));

package/src/parser/inline/autolink/anchor.ts

@@ -1,6 +1,6 @@
 import { AutolinkParser } from '../../inline';
 import { union, validate, focus, convert, fmap, lazy } from '../../../combinator';
-import { textlink } from '../link';
+import { unsafelink } from '../link';
 import { define } from 'typed-dom/dom';
 
 // Timeline(pseudonym): user/tid
@@ -21,5 +21,5 @@ export const anchor: AutolinkParser.AnchorParser = lazy(() => validate('>>', fma
         ? `/@${source.slice(2).replace('/', '/timeline/')}`
         : `?at=${source.slice(2)}`
       } }`,
-    union([textlink]))),
+    union([unsafelink]))),
   ([el]) => [define(el, { class: 'anchor' })])));

package/src/parser/inline/autolink/hashnum.ts

@@ -1,6 +1,6 @@
 import { AutolinkParser } from '../../inline';
 import { union, rewrite, open, convert, fmap, lazy } from '../../../combinator';
-import { textlink } from '../link';
+import { unsafelink } from '../link';
 import { emoji } from './hashtag';
 import { str } from '../../source';
 import { define } from 'typed-dom/dom';
@@ -9,5 +9,5 @@ export const hashnum: AutolinkParser.HashnumParser = lazy(() => fmap(rewrite(
   open('#', str(new RegExp(/^[0-9]{1,16}(?![^\p{C}\p{S}\p{P}\s]|emoji|['_])/u.source.replace(/emoji/, emoji), 'u'))),
   convert(
     source => `[${source}]{ ${source.slice(1)} }`,
-    union([textlink]))),
+    union([unsafelink]))),
   ([el]) => [define(el, { class: 'hashnum', href: null })]));

package/src/parser/inline/autolink/hashtag.ts

@@ -1,6 +1,6 @@
 import { AutolinkParser } from '../../inline';
 import { union, tails, verify, rewrite, open, convert, fmap, lazy } from '../../../combinator';
-import { textlink } from '../link';
+import { unsafelink } from '../link';
 import { str } from '../../source';
 import { define } from 'typed-dom/dom';
 
@@ -31,5 +31,5 @@ export const hashtag: AutolinkParser.HashtagParser = lazy(() => fmap(rewrite(
         ? `https://${source.slice(1).replace('/', '/hashtags/')}`
         : `/hashtags/${source.slice(1)}`
       } }`,
-    union([textlink]))),
+    union([unsafelink]))),
   ([el]) => [define(el, { class: 'hashtag' }, el.innerText)]));

package/src/parser/inline/autolink/url.ts

@@ -1,6 +1,6 @@
 import { AutolinkParser } from '../../inline';
 import { union, some, creation, precedence, validate, focus, rewrite, convert, surround, open, lazy } from '../../../combinator';
-import { textlink } from '../link';
+import { unsafelink } from '../link';
 import { unescsource } from '../../source';
 
 const closer = /^[-+*=~^,.;:!?]*(?=[\\"`|\[\](){}<>]|$)/;
@@ -11,7 +11,7 @@ export const url: AutolinkParser.UrlParser = lazy(() => validate(['http://', 'ht
     focus(/^[\x21-\x7E]+/, some(union([bracket, some(unescsource, closer)])))),
   convert(
     url => `{ ${url} }`,
-    union([textlink])))));
+    union([unsafelink])))));
 
 const bracket: AutolinkParser.UrlParser.BracketParser = lazy(() => creation(precedence(2, union([
   surround('(', some(union([bracket, unescsource]), ')'), ')', true),

package/src/parser/inline/link.ts

@@ -1,7 +1,8 @@
 import { undefined, location, encodeURI, decodeURI, Location } from 'spica/global';
-import { LinkParser, TextLinkParser } from '../inline';
-import { eval, exec } from '../../combinator/data/parser';
-import { union, inits, tails, subsequence, some, constraint, syntax, creation, precedence, state, validate, surround, open, dup, reverse, lazy, fmap, bind } from '../../combinator';
+import { MarkdownParser } from '../../../markdown';
+import { LinkParser } from '../inline';
+import { Result, eval, exec } from '../../combinator/data/parser';
+import { union, inits, tails, sequence, some, constraint, syntax, creation, precedence, state, validate, surround, open, dup, reverse, lazy, fmap, bind } from '../../combinator';
 import { inline, media, shortmedia } from '../inline';
 import { attributes } from './html';
 import { autolink } from '../autolink';
@@ -17,82 +18,72 @@ const optspec = {
 } as const;
 Object.setPrototypeOf(optspec, null);
 
-export const link: LinkParser = lazy(() => validate(['[', '{'], bind(
+export const link: LinkParser = lazy(() => validate(['[', '{'], union([
+  medialink,
+  textlink,
+])));
+
+const textlink: LinkParser.TextLinkParser = lazy(() =>
   constraint(State.link, false,
-  creation(10,
-  fmap(subsequence([
-    state(State.link,
-    dup(union([
-      surround('[', media, ']'),
-      surround('[', shortmedia, ']'),
-      surround(
-        '[',
-        state(State.annotation | State.reference | State.index | State.label | State.media | State.autolink,
-        syntax(Syntax.link, 2, 0,
-        some(inline, ']', [[/^\\?\n/, 9], [']', 2]]))),
-        ']',
-        true),
-    ]))),
+  state(State.link | State.media | State.annotation | State.reference | State.index | State.label | State.autolink,
+  syntax(Syntax.link, 2, 10,
+  bind(reverse(tails([
+    dup(surround(
+      '[',
+      some(union([inline]), ']', [[/^\\?\n/, 9], [']', 2]]),
+      ']',
+      true)),
     dup(surround(/^{(?![{}])/, inits([uri, some(option)]), /^[^\S\n]*}/)),
-  ], nodes => nodes[0][0] !== ''),
-  ([as, bs = []]) => bs[0] === '\r' && bs.shift() ? [as, bs] : as[0] === '\r' && as.shift() ? [[], as] : [as, []]))),
-  ([content, params]: [(HTMLElement | string)[], string[]], rest, context) => {
-    assert(content[0] !== '' || params.length === 0);
-    if (content[0] === '') return [content, rest];
-    if (params.length === 0) return;
+  ])),
+  ([params, content = []]: [string[], (HTMLElement | string)[]], rest, context) => {
+    assert(params.length > 0);
     assert(params.every(p => typeof p === 'string'));
     if (content.length !== 0 && trimNode(content).length === 0) return;
     for (let source = stringify(content); source;) {
-      const result = autolink(source, context);
+      const result = state(State.autolink, false, autolink)(source, context);
       if (typeof eval(result!)[0] === 'object') return;
       source = exec(result!);
     }
-    assert(!html('div', content).querySelector('a, .media, .annotation, .reference') || (content[0] as HTMLElement).matches('.media'));
-    const INSECURE_URI = params.shift()!;
-    assert(INSECURE_URI === INSECURE_URI.trim());
-    assert(!INSECURE_URI.match(/\s/));
-    const el = elem(
-      INSECURE_URI,
-      defrag(content),
-      new ReadonlyURL(
-        resolve(INSECURE_URI, context.host ?? location, context.url ?? context.host ?? location),
-        context.host?.href || location.href),
-      context.host?.origin || location.origin);
-    if (el.className === 'invalid') return [[el], rest];
-    assert(el.classList.length === 0);
-    return [[define(el, attributes('link', [], optspec, params))], rest];
-  })));
+    assert(!html('div', content).querySelector('a, .media, .annotation, .reference'));
+    return parse(content, params, rest, context);
+  })))));
+
+const medialink: LinkParser.MediaLinkParser = lazy(() =>
+  constraint(State.link | State.media, false,
+  state(State.link | State.annotation | State.reference | State.index | State.label | State.autolink,
+  syntax(Syntax.link, 2, 10,
+  bind(reverse(sequence([
+    dup(surround(
+      '[',
+      union([media, shortmedia]),
+      ']')),
+    dup(surround(/^{(?![{}])/, inits([uri, some(option)]), /^[^\S\n]*}/)),
+  ])),
+  ([params, content = []]: [string[], (HTMLElement | string)[]], rest, context) => {
+    assert(params.length > 0);
+    assert(params.every(p => typeof p === 'string'));
+    assert(content.length === 1);
+    return parse(content, params, rest, context);
+  })))));
 
-export const textlink: TextLinkParser = lazy(() => validate(['[', '{'], bind(
+export const unsafelink: LinkParser.UnsafeLinkParser = lazy(() => validate(['[', '{'], bind(
   creation(10, precedence(2,
   reverse(tails([
-    dup(surround('[', some(union([unescsource]), ']'), ']')),
+    dup(surround(
+      '[',
+      some(union([unescsource]), ']'),
+      ']')),
     dup(surround(/^{(?![{}])/, inits([uri, some(option)]), /^[^\S\n]*}/)),
   ])))),
   ([params, content = []], rest, context) => {
-    assert(params[0] === '\r');
-    params.shift();
     assert(params.every(p => typeof p === 'string'));
-    trimNode(content);
-    const INSECURE_URI = params.shift()!;
-    assert(INSECURE_URI === INSECURE_URI.trim());
-    assert(!INSECURE_URI.match(/\s/));
-    const el = elem(
-      INSECURE_URI,
-      defrag(content),
-      new ReadonlyURL(
-        resolve(INSECURE_URI, context.host ?? location, context.url ?? context.host ?? location),
-        context.host?.href || location.href),
-      context.host?.origin || location.origin);
-    assert(el.className !== 'invalid');
-    assert(el.classList.length === 0);
-    return [[define(el, attributes('link', [], optspec, params))], rest];
+    return parse(content, params, rest, context);
   })));
 
-export const uri: LinkParser.ParameterParser.UriParser = fmap(union([
+export const uri: LinkParser.ParameterParser.UriParser = union([
   open(/^[^\S\n]+/, str(/^\S+/)),
   str(/^[^\s{}]+/),
-]), ([uri]) => ['\r', uri]);
+]);
 
 export const option: LinkParser.ParameterParser.OptionParser = union([
   fmap(str(/^[^\S\n]+nofollow(?=[^\S\n]|})/), () => [` rel="nofollow"`]),
@@ -100,6 +91,27 @@ export const option: LinkParser.ParameterParser.OptionParser = union([
   fmap(str(/^[^\S\n]+[^\s{}]+/), opt => [` \\${opt.slice(1)}`]),
 ]);
 
+function parse(
+  content: (string | HTMLElement)[],
+  params: string[],
+  rest: string,
+  context: MarkdownParser.Context,
+): Result<HTMLAnchorElement, MarkdownParser.Context> {
+  const INSECURE_URI = params.shift()!;
+  assert(INSECURE_URI === INSECURE_URI.trim());
+  assert(!INSECURE_URI.match(/\s/));
+  const el = elem(
+    INSECURE_URI,
+    defrag(content),
+    new ReadonlyURL(
+      resolve(INSECURE_URI, context.host ?? location, context.url ?? context.host ?? location),
+      context.host?.href || location.href),
+    context.host?.origin || location.origin);
+  if (el.className === 'invalid') return [[el], rest];
+  assert(el.classList.length === 0);
+  return [[define(el, attributes('link', [], optspec, params))], rest];
+}
+
 export function resolve(uri: string, host: URL | Location, source: URL | Location): string {
   assert(uri);
   assert(uri === uri.trim());

package/src/parser/inline/media.ts

@@ -1,14 +1,14 @@
 import { undefined, location } from 'spica/global';
 import { MediaParser } from '../inline';
 import { union, inits, tails, some, syntax, creation, precedence, constraint, validate, verify, surround, open, dup, lazy, fmap, bind } from '../../combinator';
-import { textlink, uri, option as linkoption, resolve } from './link';
+import { unsafelink, uri, option as linkoption, resolve } from './link';
 import { attributes } from './html';
 import { unsafehtmlentity } from './htmlentity';
 import { txt, str } from '../source';
 import { Syntax, State } from '../context';
 import { html, define } from 'typed-dom/dom';
 import { ReadonlyURL } from 'spica/url';
-import { unshift, shift, push } from 'spica/array';
+import { unshift, push } from 'spica/array';
 
 const optspec = {
   'width': [],
@@ -18,19 +18,19 @@ const optspec = {
 } as const;
 Object.setPrototypeOf(optspec, null);
 
-export const media: MediaParser = lazy(() => validate(['![', '!{'], bind(verify(fmap(open(
+export const media: MediaParser = lazy(() => validate(['![', '!{'], open(
   '!',
   constraint(State.media, false,
   syntax(Syntax.media, 2, 10,
-  tails([
+  bind(verify(fmap(tails([
     dup(surround(
       '[',
       some(union([unsafehtmlentity, bracket, txt]), ']', [[/^\\?\n/, 9]]),
       ']',
       true)),
     dup(surround(/^{(?![{}])/, inits([uri, some(option)]), /^[^\S\n]*}/)),
-  ])))),
-  ([as, bs]) => bs ? [[as.join('').trim() || as.join('')], shift(bs)[1]] : [[''], shift(as)[1]]),
+  ]),
+  ([as, bs]) => bs ? [[as.join('').trim() || as.join('')], bs] : [[''], as]),
   ([[text]]) => text === '' || text.trim() !== ''),
   ([[text], params], rest, context) => {
     assert(text === text.trim());
@@ -54,12 +54,13 @@ export const media: MediaParser = lazy(() => validate(['![', '!{'], bind(verify(
     if (el.hasAttribute('aspect-ratio')) {
       el.style.aspectRatio = el.getAttribute('aspect-ratio')!;
     }
-    if (context.state! & State.link || cache && cache.tagName !== 'IMG') return [[el], rest];
+    if (context.state! & State.link) return [[el], rest];
+    if (cache && cache.tagName !== 'IMG') return creation(10, (..._) => [[el!], rest])('!', context);
     return fmap(
-      textlink as MediaParser,
+      unsafelink as MediaParser,
       ([link]) => [define(link, { target: '_blank' }, [el])])
       (`{ ${INSECURE_URI}${params.join('')} }${rest}`, context);
-  })));
+  }))))));
 
 const bracket: MediaParser.TextParser.BracketParser = lazy(() => creation(union([
   surround(str('('), some(union([unsafehtmlentity, bracket, txt]), ')'), str(')'), true, undefined, ([as, bs = []], rest) => [unshift(as, bs), rest]),

package/src/parser/inline.ts

@@ -34,7 +34,6 @@ export import MathParser = InlineParser.MathParser;
 export import ExtensionParser = InlineParser.ExtensionParser;
 export import RubyParser = InlineParser.RubyParser;
 export import LinkParser = InlineParser.LinkParser;
-export import TextLinkParser = InlineParser.TextLinkParser;
 export import HTMLParser = InlineParser.HTMLParser;
 export import InsertionParser = InlineParser.InsertionParser;
 export import DeletionParser = InlineParser.DeletionParser;