securemark 0.264.0 → 0.266.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.266.0
+
+- Change index schemas.
+- Fix footnote processing.
+
+## 0.265.0
+
+- Change ulist and olist parsers to index list items.
+- Change link parser to accept autolinks.
+
 ## 0.264.0
 
 - Change signature syntax.

package/dist/index.js

@@ -1,4 +1,4 @@
-/*! securemark v0.264.0 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED License */
+/*! securemark v0.266.0 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED License */
 (function webpackUniversalModuleDefinition(root, factory) {
 	if(typeof exports === 'object' && typeof module === 'object')
 		module.exports = factory(require("Prism"), require("DOMPurify"));
@@ -3908,6 +3908,7 @@ function bind(target, settings) {
     })
   };
 
+  if (context.id?.includes(':')) throw new Error('ID must not contain ":"');
   if (context.host?.origin === 'null') throw new Error(`Invalid host: ${context.host.href}`);
   const blocks = [];
   const adds = [];
@@ -4151,7 +4152,7 @@ function format(source) {
   return source.replace(/\r\n?/g, '\n');
 }
 function sanitize(source) {
-  return source.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]|[\u2006\u200B-\u200F\u202A-\u202F\u2060\uFEFF]|(^|[^\u1820\u1821])\u180E/g, `$1${UNICODE_REPLACEMENT_CHARACTER}`).replace(/[\uD800-\uDBFF][\uDC00-\uDFFF]?|[\uDC00-\uDFFF]/g, char => char.length === 1 ? UNICODE_REPLACEMENT_CHARACTER : char);
+  return source.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]|[\u2006\u200B-\u200F\u202A-\u202F\u2060\uFEFF]|(?<![\u1820\u1821])\u180E/g, UNICODE_REPLACEMENT_CHARACTER).replace(/[\uD800-\uDBFF][\uDC00-\uDFFF]?|[\uDC00-\uDFFF]/g, char => char.length === 1 ? UNICODE_REPLACEMENT_CHARACTER : char);
 }
 // https://dev.w3.org/html5/html-author/charref
 // https://en.wikipedia.org/wiki/Whitespace_character
@@ -4224,7 +4225,8 @@ const footnote_1 = __webpack_require__(7529);
 const url_1 = __webpack_require__(2261);
 const dom_1 = __webpack_require__(3252);
 function parse(source, opts = {}, context) {
-  if (!(0, segment_1.validate)(source, segment_1.MAX_SEGMENT_SIZE)) throw new Error(`Too large input over ${segment_1.MAX_SEGMENT_SIZE.toLocaleString('en')} bytes.`);
+  if (!(0, segment_1.validate)(source, segment_1.MAX_SEGMENT_SIZE)) throw new Error(`Too large input over ${segment_1.MAX_SEGMENT_SIZE.toLocaleString('en')} bytes`);
+  if (context?.id?.includes(':')) throw new Error('ID must not contain ":"');
   const url = (0, header_2.headers)(source).find(field => field.toLowerCase().startsWith('url:'))?.slice(4).trim() ?? '';
   source = !context ? (0, normalize_1.normalize)(source) : source;
   context = {
@@ -4263,7 +4265,7 @@ exports.parse = parse;
 
 /***/ }),
 
-/***/ 6578:
+/***/ 7185:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
@@ -4366,7 +4368,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports.blockquote = exports.segment = void 0;
 const combinator_1 = __webpack_require__(2087);
-const autolink_1 = __webpack_require__(6578);
+const autolink_1 = __webpack_require__(7185);
 const source_1 = __webpack_require__(6743);
 const parse_1 = __webpack_require__(5013);
 const dom_1 = __webpack_require__(3252);
@@ -4374,7 +4376,7 @@ exports.segment = (0, combinator_1.block)((0, combinator_1.validate)(['!>', '>']
 exports.blockquote = (0, combinator_1.lazy)(() => (0, combinator_1.block)((0, combinator_1.rewrite)(exports.segment, (0, combinator_1.union)([(0, combinator_1.open)(/^(?=>)/, source), (0, combinator_1.open)(/^!(?=>)/, markdown)]))));
 const opener = /^(?=>>+(?:$|\s))/;
 const indent = (0, combinator_1.block)((0, combinator_1.open)(opener, (0, combinator_1.some)(source_1.contentline, /^>(?:$|\s)/)), false);
-const unindent = source => source.replace(/(^|\n)>(?:[^\S\n]|(?=>*(?:$|\s)))|\n$/g, '$1');
+const unindent = source => source.replace(/(?<=^|\n)>(?:[^\S\n]|(?=>*(?:$|\s)))|\n$/g, '');
 const source = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.some)((0, combinator_1.creation)(1, false, (0, combinator_1.union)([(0, combinator_1.rewrite)(indent, (0, combinator_1.convert)(unindent, source)), (0, combinator_1.rewrite)((0, combinator_1.some)(source_1.contentline, opener), (0, combinator_1.convert)(unindent, (0, combinator_1.fmap)((0, combinator_1.some)(autolink_1.autolink), ns => [(0, dom_1.html)('pre', (0, dom_1.defrag)(ns))])))]))), ns => [(0, dom_1.html)('blockquote', ns)]));
 const markdown = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.some)((0, combinator_1.creation)(1, false, (0, combinator_1.union)([(0, combinator_1.rewrite)(indent, (0, combinator_1.convert)(unindent, markdown)), (0, combinator_1.creation)(99, false, (0, combinator_1.rewrite)((0, combinator_1.some)(source_1.contentline, opener), (0, combinator_1.convert)(unindent, ({
   source,
@@ -4406,7 +4408,7 @@ Object.defineProperty(exports, "__esModule", ({
 exports.codeblock = exports.segment_ = exports.segment = void 0;
 const parser_1 = __webpack_require__(6728);
 const combinator_1 = __webpack_require__(2087);
-const autolink_1 = __webpack_require__(6578);
+const autolink_1 = __webpack_require__(7185);
 const dom_1 = __webpack_require__(3252);
 const opener = /^(`{3,})(?!`)([^\n]*)(?:$|\n)/;
 const language = /^[0-9a-z]+(?:-[a-z][0-9a-z]*)*$/i;
@@ -4539,8 +4541,6 @@ exports.aside = (0, combinator_1.block)((0, combinator_1.validate)('~~~', (0, co
       references
     }
   }, context);
-  // Bug: Firefox
-  //const heading = document.querySelector(':scope > h1:first-child');
   const heading = 'H1 H2 H3 H4 H5 H6'.split(' ').includes(document.firstElementChild?.tagName) && document.firstElementChild;
   if (!heading) return [(0, dom_1.html)('pre', {
     class: 'invalid',
@@ -4550,7 +4550,7 @@ exports.aside = (0, combinator_1.block)((0, combinator_1.validate)('~~~', (0, co
     'data-invalid-message': 'Missing the title at the first line'
   }, `${opener}${body}${closer}`)];
   return [(0, dom_1.html)('aside', {
-    id: (0, indexee_1.identity)((0, indexee_1.text)(heading)),
+    id: (0, indexee_1.identity)(context.id, (0, indexee_1.text)(heading)),
     class: 'aside'
   }, [document, (0, dom_1.html)('h2', 'References'), references])];
 })));
@@ -5455,7 +5455,7 @@ const parser_1 = __webpack_require__(6728);
 const combinator_1 = __webpack_require__(2087);
 const math_1 = __webpack_require__(8946);
 const source_1 = __webpack_require__(6743);
-const autolink_1 = __webpack_require__(6578);
+const autolink_1 = __webpack_require__(7185);
 const dom_1 = __webpack_require__(3252);
 exports.syntax = /^>+(?=[^\S\n])|^>(?=[^\s>])|^>+(?=[^\s>])(?![0-9a-z]+(?:-[0-9a-z]+)*(?![0-9A-Za-z@#:]))/;
 exports.quote = (0, combinator_1.lazy)(() => (0, combinator_1.creation)(1, false, (0, combinator_1.block)((0, combinator_1.fmap)((0, combinator_1.validate)('>', (0, combinator_1.union)([(0, combinator_1.rewrite)((0, combinator_1.some)((0, combinator_1.validate)(new RegExp(exports.syntax.source.split('|')[0]), source_1.anyline)), qblock), (0, combinator_1.rewrite)((0, combinator_1.validate)(new RegExp(exports.syntax.source.split('|').slice(1).join('|')), source_1.anyline), (0, combinator_1.line)((0, combinator_1.union)([(0, source_1.str)(/^.+/)])))])), ns => [(0, dom_1.html)('span', ns.length > 1 ? {
@@ -5516,7 +5516,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports.sidefence = void 0;
 const combinator_1 = __webpack_require__(2087);
-const autolink_1 = __webpack_require__(6578);
+const autolink_1 = __webpack_require__(7185);
 const source_1 = __webpack_require__(6743);
 const dom_1 = __webpack_require__(3252);
 exports.sidefence = (0, combinator_1.lazy)(() => (0, combinator_1.block)((0, combinator_1.fmap)((0, combinator_1.focus)(/^(?=\|+(?:[^\S\n]|\n\|))(?:\|+(?:[^\S\n][^\n]*)?(?:$|\n))+$/, (0, combinator_1.union)([source])), ([el]) => [(0, dom_1.define)(el, {
@@ -5526,7 +5526,7 @@ exports.sidefence = (0, combinator_1.lazy)(() => (0, combinator_1.block)((0, com
   'data-invalid-message': 'Reserved syntax'
 })])));
 const opener = /^(?=\|\|+(?:$|\s))/;
-const unindent = source => source.replace(/(^|\n)\|(?:[^\S\n]|(?=\|*(?:$|\s)))|\n$/g, '$1');
+const unindent = source => source.replace(/(?<=^|\n)\|(?:[^\S\n]|(?=\|*(?:$|\s)))|\n$/g, '');
 const source = (0, combinator_1.lazy)(() => (0, combinator_1.fmap)((0, combinator_1.some)((0, combinator_1.creation)(1, false, (0, combinator_1.union)([(0, combinator_1.focus)(/^(?:\|\|+(?:[^\S\n][^\n]*)?(?:$|\n))+/, (0, combinator_1.convert)(unindent, source)), (0, combinator_1.rewrite)((0, combinator_1.some)(source_1.contentline, opener), (0, combinator_1.convert)(unindent, (0, combinator_1.fmap)((0, combinator_1.some)(autolink_1.autolink), ns => [(0, dom_1.html)('pre', (0, dom_1.defrag)(ns))])))]))), ns => [(0, dom_1.html)('blockquote', ns)]));
 
 /***/ }),
@@ -5687,7 +5687,7 @@ const insertion_1 = __webpack_require__(2945);
 const deletion_1 = __webpack_require__(7501);
 const mark_1 = __webpack_require__(2480);
 const emphasis_1 = __webpack_require__(3867);
-const strong_1 = __webpack_require__(8072);
+const strong_1 = __webpack_require__(6578);
 const code_1 = __webpack_require__(5771);
 const media_1 = __webpack_require__(1303);
 const htmlentity_1 = __webpack_require__(1562);
@@ -6106,7 +6106,7 @@ exports.index = (0, combinator_1.lazy)(() => (0, combinator_1.validate)('[#', (0
 }, el.childNodes)])));
 const signature = (0, combinator_1.lazy)(() => (0, combinator_1.creation)((0, combinator_1.fmap)((0, combinator_1.open)('|', (0, visibility_1.startTight)((0, combinator_1.some)((0, combinator_1.union)([bracket, source_1.txt]), ']'))), ns => [(0, dom_1.html)('span', {
   class: 'indexer',
-  'data-index': (0, indexee_1.identity)(ns.join('')).slice(6)
+  'data-index': (0, indexee_1.identity)(undefined, ns.join('')).slice(7)
 })])));
 const bracket = (0, combinator_1.lazy)(() => (0, combinator_1.creation)((0, combinator_1.union)([(0, combinator_1.surround)((0, source_1.str)('('), (0, combinator_1.some)((0, combinator_1.union)([bracket, source_1.txt]), ')'), (0, source_1.str)(')'), true), (0, combinator_1.surround)((0, source_1.str)('['), (0, combinator_1.some)((0, combinator_1.union)([bracket, source_1.txt]), ']'), (0, source_1.str)(']'), true), (0, combinator_1.surround)((0, source_1.str)('{'), (0, combinator_1.some)((0, combinator_1.union)([bracket, source_1.txt]), '}'), (0, source_1.str)('}'), true), (0, combinator_1.surround)((0, source_1.str)('"'), (0, combinator_1.precedence)(8, (0, combinator_1.some)(source_1.txt, '"')), (0, source_1.str)('"'), true)])));
 
@@ -6128,46 +6128,46 @@ function indexee(parser, optional) {
   return (0, combinator_1.fmap)(parser, ([el], _, {
     id
   }) => [(0, dom_1.define)(el, {
-    id: id !== '' && identity(text(el, optional)) || undefined
+    id: identity(id, text(el, optional))
   })]);
 }
 exports.indexee = indexee;
-function identity(text, name = 'index') {
+function identity(id, text, name = 'index') {
+  if (id === '') return undefined;
   text &&= text.trim().replace(/\s+/g, '_');
-  if (text.length <= 100) return text && `${name}:${text}`;
+  if (text === '') return undefined;
+  if (text.length <= 100) return `${name}:${id ?? ''}:${text}`;
   switch (name) {
     case 'index':
-      return `${name}:${text.slice(0, 97)}...`;
+      return `${name}:${id ?? ''}:${text.slice(0, 97)}...`;
     case 'mark':
-      return `${name}:${text.slice(0, 50)}...${text.slice(-47)}`;
+      return `${name}:${id ?? ''}:${text.slice(0, 50)}...${text.slice(-47)}`;
   }
 }
 exports.identity = identity;
 function text(source, optional = false) {
   const indexer = source.querySelector(':scope > .indexer');
-  if (!indexer && optional) return '';
   const index = indexer?.getAttribute('data-index');
   if (index) return index;
+  if (index === '' && optional) return '';
   const target = source.cloneNode(true);
   for (let es = target.querySelectorAll('code[data-src], .math[data-src], .comment, rt, rp, br, .annotation, .reference, .checkbox, ul, ol'), len = es.length, i = 0; i < len; ++i) {
     const el = es[i];
     switch (el.tagName) {
       case 'CODE':
-        (0, dom_1.define)(el, el.getAttribute('data-src'));
+        el.replaceWith(el.getAttribute('data-src'));
         continue;
       case 'RT':
       case 'RP':
+      case 'BR':
       case 'UL':
       case 'OL':
         el.remove();
         continue;
-      case 'BR':
-        el.replaceWith('\n');
-        continue;
     }
     switch (el.className) {
       case 'math':
-        (0, dom_1.define)(el, el.getAttribute('data-src'));
+        el.replaceWith(el.getAttribute('data-src'));
         continue;
       case 'comment':
       case 'checkbox':
@@ -6204,7 +6204,7 @@ exports.indexer = (0, combinator_1.creation)((0, combinator_1.fmap)((0, combinat
 // Indexer is invisible but invalids must be visible.
 ([el]) => el.getElementsByClassName('invalid').length === 0), ([el]) => [(0, dom_1.html)('span', {
   class: 'indexer',
-  'data-index': el.getAttribute('href').slice(7)
+  'data-index': el.getAttribute('href').slice(1).replace(/^\w+:\w*:/, '')
 })]));
 
 /***/ }),
@@ -6411,11 +6411,9 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.resolve = exports.option = exports.uri = exports.unsafelink = exports.link = void 0;
-const parser_1 = __webpack_require__(6728);
 const combinator_1 = __webpack_require__(2087);
 const inline_1 = __webpack_require__(1160);
 const html_1 = __webpack_require__(5994);
-const autolink_1 = __webpack_require__(6578);
 const source_1 = __webpack_require__(6743);
 const visibility_1 = __webpack_require__(7618);
 const util_1 = __webpack_require__(9437);
@@ -6433,22 +6431,11 @@ const medialink = (0, combinator_1.lazy)(() => (0, combinator_1.constraint)(16 /
 exports.unsafelink = (0, combinator_1.lazy)(() => (0, combinator_1.creation)(10, (0, combinator_1.precedence)(2, (0, combinator_1.bind)((0, combinator_1.reverse)((0, combinator_1.tails)([(0, combinator_1.dup)((0, combinator_1.surround)('[', (0, combinator_1.some)((0, combinator_1.union)([source_1.unescsource]), ']'), ']')), (0, combinator_1.dup)((0, combinator_1.surround)(/^{(?![{}])/, (0, combinator_1.inits)([exports.uri, (0, combinator_1.some)(exports.option)]), /^[^\S\n]*}/))])), ([params, content = []], rest, context) => parse(content, params, rest, context)))));
 exports.uri = (0, combinator_1.union)([(0, combinator_1.open)(/^[^\S\n]+/, (0, source_1.str)(/^\S+/)), (0, source_1.str)(/^[^\s{}]+/)]);
 exports.option = (0, combinator_1.union)([(0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+nofollow(?=[^\S\n]|})/), () => [` rel="nofollow"`]), (0, source_1.str)(/^[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|})/), (0, combinator_1.fmap)((0, source_1.str)(/^[^\S\n]+[^\s{}]+/), opt => [` \\${opt.slice(1)}`])]);
-const autolink = (0, combinator_1.state)(2 /* State.autolink */, false, (0, combinator_1.state)(1 /* State.shortcut */, autolink_1.autolink));
 function parse(content, params, rest, context) {
   if (content.length !== 0 && (0, visibility_1.trimNode)(content).length === 0) return;
-  content = (0, dom_1.defrag)(content);
-  for (let source = (0, util_1.stringify)(content); source;) {
-    if (/^[a-z][0-9a-z]*(?:[-.][0-9a-z]+)*:(?:\/{0,2}[^/?#\s]+|\/\/(?=[/]))/i.test(source)) return;
-    const result = autolink({
-      source,
-      context
-    });
-    if (typeof (0, parser_1.eval)(result, [])[0] === 'object') return;
-    source = (0, parser_1.exec)(result, '');
-  }
   const INSECURE_URI = params.shift();
   const uri = new url_1.ReadonlyURL(resolve(INSECURE_URI, context.host ?? location, context.url ?? context.host ?? location), context.host?.href || location.href);
-  const el = elem(INSECURE_URI, content, uri, context.host?.origin || location.origin);
+  const el = elem(INSECURE_URI, (0, dom_1.defrag)(content), uri, context.host?.origin || location.origin);
   if (el.className === 'invalid') return [[el], rest];
   return [[(0, dom_1.define)(el, (0, html_1.attributes)('link', [], optspec, params))], rest];
 }
@@ -6459,6 +6446,10 @@ function elem(INSECURE_URI, content, uri, origin) {
     case 'http:':
     case 'https:':
       switch (true) {
+        case /[a-z][0-9]*:\/{0,2}\S/i.test((0, util_1.stringify)(content)):
+          type = 'content';
+          message = 'URI must not be contained';
+          break;
         case INSECURE_URI.slice(0, 2) === '^/' && /\/\.\.?(?:\/|$)/.test(INSECURE_URI.slice(0, INSECURE_URI.search(/[?#]|$/))):
           type = 'argument';
           message = 'Dot-segments cannot be used in subresource paths';
@@ -6484,6 +6475,7 @@ function elem(INSECURE_URI, content, uri, origin) {
           type = 'content';
           message = 'Invalid content';
       }
+      break;
   }
   return (0, dom_1.html)('a', {
     class: 'invalid',
@@ -6512,7 +6504,7 @@ function decode(uri) {
   const origin = uri.match(/^[a-z](?:[-.](?=\w)|[0-9a-z])*:(?:\/{0,2}[^/?#\s]+|\/\/(?=[/]))/i)?.[0] ?? '';
   try {
     let path = decodeURI(uri.slice(origin.length));
-    if (!origin && /^[a-z](?:[-.](?=\w)|[0-9a-z])*:(?:\/{0,2}[^/?#\s]+|\/\/(?=[/]))/i.test(path)) {
+    if (!origin && /^[a-z](?:[-.](?=\w)|[0-9a-z])*:\/{0,2}\S/i.test(path)) {
       path = uri.slice(origin.length);
     }
     uri = origin + path;
@@ -6545,7 +6537,7 @@ exports.mark = (0, combinator_1.lazy)(() => (0, combinator_1.surround)((0, sourc
 }) => {
   const el = (0, dom_1.html)('mark', (0, dom_1.defrag)(bs));
   (0, dom_1.define)(el, {
-    id: id !== '' && (0, indexee_1.identity)((0, indexee_1.text)(el), 'mark') || undefined
+    id: (0, indexee_1.identity)(id, (0, indexee_1.text)(el), 'mark')
   });
   return [[el, (0, dom_1.html)('a', {
     href: el.id ? `#${el.id}` : undefined
@@ -6831,7 +6823,7 @@ exports.shortmedia = (0, combinator_1.rewrite)((0, combinator_1.constraint)(8 /*
 
 /***/ }),
 
-/***/ 8072:
+/***/ 6578:
 /***/ ((__unused_webpack_module, exports, __webpack_require__) => {
 
 "use strict";
@@ -6894,8 +6886,6 @@ function* figure(target, footnotes, opts = {}) {
   let base = '0';
   let bases = base.split('.');
   let index = bases;
-  // Bug: Firefox
-  //for (let defs = target.querySelectorAll(':scope > figure[data-label], :scope > h1, :scope > h2'), len = defs.length, i = 0; i < len; ++i) {
   for (let defs = target.querySelectorAll('figure[data-label], h1, h2'), len = defs.length, i = 0; i < len; ++i) {
     yield;
     const def = defs[i];
@@ -7056,8 +7046,6 @@ const indexee_1 = __webpack_require__(1269);
 const queue_1 = __webpack_require__(4934);
 const dom_1 = __webpack_require__(3252);
 function* footnote(target, footnotes, opts = {}, bottom = null) {
-  // Bug: Firefox
-  //target.querySelectorAll(`:scope > .annotations`).forEach(el => el.remove());
   for (let es = target.querySelectorAll(`.annotations`), len = es.length, i = 0; i < len; ++i) {
     const el = es[i];
     el.parentNode === target && el.remove();
@@ -7076,8 +7064,6 @@ function build(syntax, marker, splitter) {
     const defs = new Map();
     const buffer = new queue_1.MultiQueue();
     const titles = new Map();
-    // Bug: Firefox
-    //const splitters = push([], target.querySelectorAll(`:scope > :is(${splitter ?? '_'})`));
     const splitters = [];
     for (let es = target.querySelectorAll(splitter ?? '_'), len = es.length, i = 0; i < len; ++i) {
       const el = es[i];
@@ -7089,16 +7075,18 @@ function build(syntax, marker, splitter) {
     for (let refs = target.querySelectorAll(`sup.${syntax}:not(.disabled)`), len = refs.length, i = 0; i < len; ++i) {
       yield;
       const ref = refs[i];
-      while (+splitters[0]?.compareDocumentPosition(ref) & Node.DOCUMENT_POSITION_FOLLOWING) {
+      while (splitters.length > 0 && splitters[0].compareDocumentPosition(ref) & Node.DOCUMENT_POSITION_FOLLOWING) {
         if (defs.size > 0) {
           total += defs.size;
           yield* proc(defs, target.insertBefore((0, dom_1.html)('ol', {
             class: `${syntax}s`
-          }), splitters[0] ?? null));
+          }), splitters[0]));
+        } else if (splitters.length % 100 === 0) {
+          yield;
         }
         splitters.shift();
       }
-      const identifier = `${+!ref.querySelector('.label')}:${ref.getAttribute('data-abbr') || '_' + ref.firstElementChild.innerHTML}`;
+      const identifier = ref.getAttribute('data-abbr') || ` ${ref.firstElementChild.innerHTML}`;
       const abbr = ref.getAttribute('data-abbr') || undefined;
       const content = (0, dom_1.frag)(ref.firstElementChild.cloneNode(true).childNodes);
       style ??= abbr ? 'abbr' : 'count';
@@ -7122,13 +7110,13 @@ function build(syntax, marker, splitter) {
       } else {
         ref.lastChild?.remove();
       }
-      const title =  false || titles.get(identifier) || +identifier[0] && ref.title || (0, indexee_1.text)(content).trim() || content.textContent.trim() || undefined;
+      const title = titles.get(identifier) || (0, indexee_1.text)(content).trim() || undefined;
       title ? !titles.has(identifier) && titles.set(identifier, title) : buffer.set(identifier, ref);
       const blank = !!abbr && !content.firstChild;
       const refIndex = ++count;
-      const refId = opts.id !== '' ? ref.id || `${syntax}:${opts.id ? `${opts.id}:` : ''}ref:${refIndex}` : undefined;
+      const refId = opts.id !== '' ? `${syntax}:${opts.id ?? ''}:ref:${refIndex}` : undefined;
       const def =  false || defs.get(identifier) || defs.set(identifier, (0, dom_1.html)('li', {
-        id: opts.id !== '' ? `${syntax}:${opts.id ? `${opts.id}:` : ''}def:${total + defs.size + 1}` : undefined,
+        id: opts.id !== '' ? `${syntax}:${opts.id ?? ''}:def:${total + defs.size + 1}` : undefined,
         'data-marker': !footnote ? marker(total + defs.size + 1, abbr) : undefined
       }, [content.cloneNode(true), (0, dom_1.html)('sup')])).get(identifier);
       if (title && !blank && def.childNodes.length === 1) {
@@ -8331,8 +8319,6 @@ Object.defineProperty(exports, "__esModule", ({
 exports.toc = void 0;
 const array_1 = __webpack_require__(8112);
 const dom_1 = __webpack_require__(3252);
-// Bug: Firefox
-//const selector = `:scope > :is(h1, h2, h3, h4, h5, h6, aside.aside)[id]`;
 const selector = ':is(h1, h2, h3, h4, h5, h6, aside.aside)[id]';
 function toc(source) {
   const hs = [];

package/index.d.ts

@@ -28,7 +28,8 @@ export type ParserOptions = Omit<Partial<ParserSettings>, 'chunk'>;
 export interface ParserSettings {
   // Host URL.
   readonly host?: URL;
-  // Id of comments and timelines.
+  // ID of comments and timelines.
+  // Must not contain ":".
   readonly id?: string;
   // For editing.
   readonly caches?: Partial<Caches>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.264.0",
+  "version": "0.266.0",
   "description": "Secure markdown renderer working on browsers for user input data.",
   "private": false,
   "homepage": "https://github.com/falsandtru/securemark",

package/src/combinator/data/parser/some.ts

@@ -4,7 +4,8 @@ import { unshift, push } from 'spica/array';
 
 type DelimiterOption = readonly [delimiter: string | RegExp, precedence: number];
 
-export function some<P extends Parser<unknown>>(parser: P, end?: string | RegExp | number, delimiters?: readonly DelimiterOption[], limit?: number): P;
+export function some<P extends Parser<unknown>>(parser: P, limit?: number): P;
+export function some<P extends Parser<unknown>>(parser: P, end?: string | RegExp, delimiters?: readonly DelimiterOption[], limit?: number): P;
 export function some<T>(parser: Parser<T>, end?: string | RegExp | number, delimiters: readonly DelimiterOption[] = [], limit = -1): Parser<T> {
   if (typeof end === 'number') return some(parser, undefined, delimiters, end);
   assert(parser);

package/src/parser/api/bind.test.ts

@@ -122,7 +122,7 @@ describe('Unit: parser/api/bind', () => {
     });
 
     it('complex', () => {
-      assert.deepStrictEqual(inspect(bind(html('div'), cfgs).parse('# a\n# b')), ['<h1 id="index:a">a</h1>', '<h1 id="index:b">b</h1>']);
+      assert.deepStrictEqual(inspect(bind(html('div'), cfgs).parse('# a\n# b')), ['<h1 id="index::a">a</h1>', '<h1 id="index::b">b</h1>']);
     });
 
     it('normalize', () => {
@@ -158,10 +158,10 @@ describe('Unit: parser/api/bind', () => {
       assert(el.innerHTML === '<p>1</p><p>2</p><p>4</p>');
       [...update('')];
       assert(el.innerHTML === '');
-      assert.deepStrictEqual(inspect(update('# a\n# b'), 1), ['<h1 id="index:a">a</h1>']);
-      assert(el.innerHTML === '<h1 id="index:a">a</h1>');
-      assert.deepStrictEqual(inspect(update('# a\n# b'), 2), ['<h1 id="index:b">b</h1>']);
-      assert(el.innerHTML === '<h1 id="index:a">a</h1><h1 id="index:b">b</h1>');
+      assert.deepStrictEqual(inspect(update('# a\n# b'), 1), ['<h1 id="index::a">a</h1>']);
+      assert(el.innerHTML === '<h1 id="index::a">a</h1>');
+      assert.deepStrictEqual(inspect(update('# a\n# b'), 2), ['<h1 id="index::b">b</h1>']);
+      assert(el.innerHTML === '<h1 id="index::a">a</h1><h1 id="index::b">b</h1>');
     });
 
     it('chunk', () => {
@@ -192,38 +192,38 @@ describe('Unit: parser/api/bind', () => {
         [...el.children].map(el => el.outerHTML),
         [
           html('p', [
-            html('sup', { class: "reference", id: "reference:ref:1", title: "1" }, [
+            html('sup', { class: "reference", id: "reference::ref:1", title: "1" }, [
               html('span', { hidden: '' }, '1'),
-              html('a', { href: "#reference:def:1" }, '[1]'),
+              html('a', { href: "#reference::def:1" }, '[1]'),
             ]),
           ]).outerHTML,
           html('p', [
-            html('sup', { class: "reference", id: "reference:ref:2", title: "2" }, [
+            html('sup', { class: "reference", id: "reference::ref:2", title: "2" }, [
               html('span', { hidden: '' }, '2'),
-              html('a', { href: "#reference:def:2" }, '[2]'),
+              html('a', { href: "#reference::def:2" }, '[2]'),
             ]),
           ]).outerHTML,
           html('p', [
-            html('sup', { class: "reference", id: "reference:ref:3", title: "3" }, [
+            html('sup', { class: "reference", id: "reference::ref:3", title: "3" }, [
               html('span', { hidden: '' }, '3'),
-              html('a', { href: "#reference:def:3" }, '[3]'),
+              html('a', { href: "#reference::def:3" }, '[3]'),
             ]),
           ]).outerHTML,
         ]);
       assert.deepStrictEqual(
         cfgs.footnotes.references?.outerHTML,
         html('ol', [
-          html('li', { id: 'reference:def:1' }, [
+          html('li', { id: 'reference::def:1' }, [
             '1',
-            html('sup', [html('a', { href: '#reference:ref:1' }, '^1')]),
+            html('sup', [html('a', { href: '#reference::ref:1' }, '^1')]),
           ]),
-          html('li', { id: 'reference:def:2' }, [
+          html('li', { id: 'reference::def:2' }, [
             '2',
-            html('sup', [html('a', { href: '#reference:ref:2' }, '^2')]),
+            html('sup', [html('a', { href: '#reference::ref:2' }, '^2')]),
           ]),
-          html('li', { id: 'reference:def:3' }, [
+          html('li', { id: 'reference::def:3' }, [
             '3',
-            html('sup', [html('a', { href: '#reference:ref:3' }, '^3')]),
+            html('sup', [html('a', { href: '#reference::ref:3' }, '^3')]),
           ]),
         ]).outerHTML);
       assert.throws(() => update('').next());

package/src/parser/api/bind.ts

@@ -26,6 +26,7 @@ export function bind(target: DocumentFragment | HTMLElement | ShadowRoot, settin
     host: settings.host ?? new ReadonlyURL(location.pathname, location.origin),
     memo: new Memo({ targets: State.backtrackers }),
   };
+  if (context.id?.includes(':')) throw new Error('ID must not contain ":"');
   if (context.host?.origin === 'null') throw new Error(`Invalid host: ${context.host.href}`);
   assert(!settings.id);
   type Block = readonly [segment: string, blocks: readonly HTMLElement[], url: string];

package/src/parser/api/normalize.ts

@@ -15,7 +15,7 @@ function format(source: string): string {
 
 function sanitize(source: string): string {
   return source
-    .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]|[\u2006\u200B-\u200F\u202A-\u202F\u2060\uFEFF]|(^|[^\u1820\u1821])\u180E/g, `$1${UNICODE_REPLACEMENT_CHARACTER}`)
+    .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]|[\u2006\u200B-\u200F\u202A-\u202F\u2060\uFEFF]|(?<![\u1820\u1821])\u180E/g, UNICODE_REPLACEMENT_CHARACTER)
     .replace(/[\uD800-\uDBFF][\uDC00-\uDFFF]?|[\uDC00-\uDFFF]/g, char =>
       char.length === 1
         ? UNICODE_REPLACEMENT_CHARACTER

package/src/parser/api/parse.test.ts

@@ -123,10 +123,10 @@ describe('Unit: parser/api/parse', () => {
           '<p><a class="channel" href="https://domain/@a?ch=b" target="_blank">@domain/a#b</a></p>',
           '<p><a class="hashtag" href="https://source/hashtags/a" target="_blank">#a</a></p>',
           '<p><a class="hashtag" href="https://domain/hashtags/a" target="_blank">#domain/a</a></p>',
-          '<p><a class="index" href="#index:a">a</a></p>',
+          '<p><a class="index" href="#index::a">a</a></p>',
           '<figure data-type="math" data-label="$-a" data-group="$" data-number="1" id="label:$-a"><figcaption><span class="figindex">(1)</span><span class="figtext"></span></figcaption><div><div class="math" translate="no">$$\n$$</div></div></figure>',
           '<p><a class="label" data-label="$-a" href="#label:$-a">(1)</a></p>',
-          '<p><sup class="annotation" id="annotation:ref:1" title="a"><span hidden="">a</span><a href="#annotation:def:1">*1</a></sup></p>',
+          '<p><sup class="annotation" id="annotation::ref:1" title="a"><span hidden="">a</span><a href="#annotation::def:1">*1</a></sup></p>',
           '<p><a class="url" href="https://source/x/a" target="_blank">a</a></p>',
           '<p><a class="url" href="https://source/a" target="_blank">/a</a></p>',
           '<p><a class="url" href="/z/a">^/a</a></p>',
@@ -137,7 +137,7 @@ describe('Unit: parser/api/parse', () => {
           '<p><a href="https://source/x/a" target="_blank"><img class="media" data-src="https://source/x/a" alt=""></a></p>',
           '<p><a href="/z/a" target="_blank"><img class="media" data-src="/z/a" alt=""></a></p>',
           '<p><a href="https://source/a" target="_blank"><img class="media" data-src="https://source/a" alt=""></a></p>',
-          '<ol class="annotations"><li id="annotation:def:1" data-marker="*1">a<sup><a href="#annotation:ref:1">^1</a></sup></li></ol>',
+          '<ol class="annotations"><li id="annotation::def:1" data-marker="*1">a<sup><a href="#annotation::ref:1">^1</a></sup></li></ol>',
         ]);
       assert.deepStrictEqual(
         [...parse([
@@ -209,12 +209,12 @@ describe('Unit: parser/api/parse', () => {
         [...parse('$-a\n$$\n$$\n\n(($-a[[b]][[c_d_]]))', { footnotes }).children].map(el => el.outerHTML),
         [
           '<figure data-type="math" data-label="$-a" data-group="$" data-number="1" id="label:$-a"><figcaption><span class="figindex">(1)</span><span class="figtext"></span></figcaption><div><div class="math" translate="no">$$\n$$</div></div></figure>',
-          '<p><sup class="annotation" id="annotation:ref:1" title="(1)"><span hidden=""><a class="label" data-label="$-a" href="#label:$-a">(1)</a><sup class="reference" id="reference:ref:1" title="b"><span hidden="">b</span><a href="#reference:def:1">[1]</a></sup><sup class="reference" id="reference:ref:2" title="cd"><span hidden="">c<em>d</em></span><a href="#reference:def:2">[2]</a></sup></span><a href="#annotation:def:1">*1</a></sup></p>',
-          '<ol class="annotations"><li id="annotation:def:1" data-marker="*1"><a class="label" data-label="$-a" href="#label:$-a">(1)</a><sup class="reference" id="reference:ref:1" title="b"><span hidden="">b</span><a href="#reference:def:1">[1]</a></sup><sup class="reference" id="reference:ref:2" title="cd"><span hidden="">c<em>d</em></span><a href="#reference:def:2">[2]</a></sup><sup><a href="#annotation:ref:1">^1</a></sup></li></ol>',
+          '<p><sup class="annotation" id="annotation::ref:1" title="(1)"><span hidden=""><a class="label" data-label="$-a" href="#label:$-a">(1)</a><sup class="reference" id="reference::ref:1" title="b"><span hidden="">b</span><a href="#reference::def:1">[1]</a></sup><sup class="reference" id="reference::ref:2" title="cd"><span hidden="">c<em>d</em></span><a href="#reference::def:2">[2]</a></sup></span><a href="#annotation::def:1">*1</a></sup></p>',
+          '<ol class="annotations"><li id="annotation::def:1" data-marker="*1"><a class="label" data-label="$-a" href="#label:$-a">(1)</a><sup class="reference" id="reference::ref:1" title="b"><span hidden="">b</span><a href="#reference::def:1">[1]</a></sup><sup class="reference" id="reference::ref:2" title="cd"><span hidden="">c<em>d</em></span><a href="#reference::def:2">[2]</a></sup><sup><a href="#annotation::ref:1">^1</a></sup></li></ol>',
         ]);
       assert.deepStrictEqual(
         footnotes.references.outerHTML,
-        '<ol><li id="reference:def:1">b<sup><a href="#reference:ref:1">^1</a></sup></li><li id="reference:def:2">c<em>d</em><sup><a href="#reference:ref:2">^2</a></sup></li></ol>');
+        '<ol><li id="reference::def:1">b<sup><a href="#reference::ref:1">^1</a></sup></li><li id="reference::def:2">c<em>d</em><sup><a href="#reference::ref:2">^2</a></sup></li></ol>');
     });
 
     it('normalize', () => {

package/src/parser/api/parse.ts

@@ -18,7 +18,8 @@ interface Options extends ParserOptions {
 }
 
 export function parse(source: string, opts: Options = {}, context?: MarkdownParser.Context): DocumentFragment {
-  if (!validate(source, MAX_SEGMENT_SIZE)) throw new Error(`Too large input over ${MAX_SEGMENT_SIZE.toLocaleString('en')} bytes.`);
+  if (!validate(source, MAX_SEGMENT_SIZE)) throw new Error(`Too large input over ${MAX_SEGMENT_SIZE.toLocaleString('en')} bytes`);
+  if (context?.id?.includes(':')) throw new Error('ID must not contain ":"');
   const url = headers(source).find(field => field.toLowerCase().startsWith('url:'))?.slice(4).trim() ?? '';
   source = !context ? normalize(source) : source;
   assert(!context?.delimiters);

package/src/parser/block/blockquote.ts

@@ -16,7 +16,7 @@ export const blockquote: BlockquoteParser = lazy(() => block(rewrite(segment, un
 
 const opener = /^(?=>>+(?:$|\s))/;
 const indent = block(open(opener, some(contentline, /^>(?:$|\s)/)), false);
-const unindent = (source: string) => source.replace(/(^|\n)>(?:[^\S\n]|(?=>*(?:$|\s)))|\n$/g, '$1');
+const unindent = (source: string) => source.replace(/(?<=^|\n)>(?:[^\S\n]|(?=>*(?:$|\s)))|\n$/g, '');
 
 const source: BlockquoteParser.SourceParser = lazy(() => fmap(
   some(creation(1, false, union([