shelving 1.267.3 → 1.267.5

package/markup/MarkupParser.d.ts

@@ -42,6 +42,13 @@ export type MarkupOptions = {
      * Default context to use if one isn't set. Defaults to `"block"`
      */
     readonly context?: string;
+    /**
+     * Current nesting depth — used to cap self-recursive rules (e.g. blockquotes) so pathological input can't
+     * overflow the stack. Internal: set automatically as rules recurse via `MarkupParser.nested()`; callers
+     * normally leave it at the default `0`.
+     * @default 0
+     */
+    readonly depth?: number | undefined;
 };
 /**
  * Parses a Markdownish markup string and renders it as a React node using a tiered, masking rule engine.
@@ -90,10 +97,29 @@ export declare class MarkupParser implements Parser<string, ReactNode> {
      * @see https://shelving.cc/markup/MarkupParser/context
      */
     readonly context: string;
-    constructor({ rules, rel, url, root, schemes, context }?: MarkupOptions);
+    /**
+     * Current nesting depth, incremented by `nested()` as self-recursive rules descend. Used to cap recursion so
+     * pathological input (e.g. a long `>>>>…` blockquote) can't overflow the stack.
+     * @see https://shelving.cc/markup/MarkupParser/depth
+     */
+    readonly depth: number;
+    constructor({ rules, rel, url, root, schemes, context, depth }?: MarkupOptions);
+    /**
+     * Return a copy of this parser with `depth` incremented by one, sharing all other options.
+     * - Self-recursive rules (e.g. blockquotes) parse their nested content through `nested()` so `depth` tracks how
+     *   deep the recursion has gone, letting them stop before the call stack overflows.
+     *
+     * @returns A new `MarkupParser` identical to this one but one level deeper.
+     * @see https://shelving.cc/markup/MarkupParser/nested
+     */
+    nested(): MarkupParser;
     /**
      * Parse a text string as Markdownish markup syntax and render it as a React node.
      * - Syntax is not defined by this code, but by the rules supplied to it.
+     * - **Untrusted input:** parsing is linear for normal content, but a few rules can still degrade on adversarial
+     *   input — long unbroken runs of backtick code fences, and deeply-nested `>` blockquotes (each leading `>`
+     *   recurses one level, so a pathological line can overflow the stack). When `input` is user-generated, cap its
+     *   length first; a sane maximum for your use case (for typical user content, tens of kilobytes) bounds worst-case work.
      *
      * @param input The string content possibly containing markup syntax, e.g. `"This is a *bold* string."`.
      * @param context The context to render in (defaults to this parser's `context`, i.e. `"block"` unless overridden).

package/markup/MarkupParser.js

@@ -48,7 +48,13 @@ export class MarkupParser {
      * @see https://shelving.cc/markup/MarkupParser/context
      */
     context;
-    constructor({ rules = MARKUP_RULES, rel, url, root, schemes = HTTP_SCHEMES, context = "block" } = {}) {
+    /**
+     * Current nesting depth, incremented by `nested()` as self-recursive rules descend. Used to cap recursion so
+     * pathological input (e.g. a long `>>>>…` blockquote) can't overflow the stack.
+     * @see https://shelving.cc/markup/MarkupParser/depth
+     */
+    depth;
+    constructor({ rules = MARKUP_RULES, rel, url, root, schemes = HTTP_SCHEMES, context = "block", depth = 0 } = {}) {
         this.rules = rules;
         this.priorities = _getPriorities(rules);
         this.rel = rel;
@@ -56,10 +62,34 @@ export class MarkupParser {
         this.root = root;
         this.schemes = schemes;
         this.context = context;
+        this.depth = depth;
+    }
+    /**
+     * Return a copy of this parser with `depth` incremented by one, sharing all other options.
+     * - Self-recursive rules (e.g. blockquotes) parse their nested content through `nested()` so `depth` tracks how
+     *   deep the recursion has gone, letting them stop before the call stack overflows.
+     *
+     * @returns A new `MarkupParser` identical to this one but one level deeper.
+     * @see https://shelving.cc/markup/MarkupParser/nested
+     */
+    nested() {
+        return new MarkupParser({
+            rules: this.rules,
+            rel: this.rel,
+            url: this.url,
+            root: this.root,
+            schemes: this.schemes,
+            context: this.context,
+            depth: this.depth + 1,
+        });
     }
     /**
      * Parse a text string as Markdownish markup syntax and render it as a React node.
      * - Syntax is not defined by this code, but by the rules supplied to it.
+     * - **Untrusted input:** parsing is linear for normal content, but a few rules can still degrade on adversarial
+     *   input — long unbroken runs of backtick code fences, and deeply-nested `>` blockquotes (each leading `>`
+     *   recurses one level, so a pathological line can overflow the stack). When `input` is user-generated, cap its
+     *   length first; a sane maximum for your use case (for typical user content, tens of kilobytes) bounds worst-case work.
      *
      * @param input The string content possibly containing markup syntax, e.g. `"This is a *bold* string."`.
      * @param context The context to render in (defaults to this parser's `context`, i.e. `"block"` unless overridden).

package/markup/rule/blockquote.d.ts

@@ -3,6 +3,7 @@
  * - `>` quote character followed by zero or more spaces.
  * - No spaces can appear before the `>` quote character.
  * - Quote block is only broken by `\n\n` two newline characters.
+ * - Nesting is capped at `MAX_DEPTH` (10) levels; deeper `>` prefixes are rendered as plain text rather than recursed, so pathological input can't overflow the stack.
  *
  * @example new MarkupParser({ rules: [BLOCKQUOTE_RULE] }).parse("> Quoted text")
  * @see https://shelving.cc/markup/BLOCKQUOTE_RULE

package/markup/rule/blockquote.js

@@ -3,13 +3,23 @@ import { createMarkupRule } from "../MarkupRule.js";
 import { BLOCK_CONTENT_REGEXP, createBlockRegExp } from "../util/regexp.js";
 const PREFIX = ">";
 const INDENT = new RegExp(`^${PREFIX}`, "gm");
+/** Maximum blockquote nesting depth. Each `>` level recurses once, so an unbounded `>>>>…` line would overflow the stack; beyond this the remaining source is left as plain text. */
+const MAX_DEPTH = 10;
 /**
  * Blockquote block.
  * - `>` quote character followed by zero or more spaces.
  * - No spaces can appear before the `>` quote character.
  * - Quote block is only broken by `\n\n` two newline characters.
+ * - Nesting is capped at `MAX_DEPTH` (10) levels; deeper `>` prefixes are rendered as plain text rather than recursed, so pathological input can't overflow the stack.
  *
  * @example new MarkupParser({ rules: [BLOCKQUOTE_RULE] }).parse("> Quoted text")
  * @see https://shelving.cc/markup/BLOCKQUOTE_RULE
  */
-export const BLOCKQUOTE_RULE = createMarkupRule(createBlockRegExp(`(?<quote>${PREFIX}${BLOCK_CONTENT_REGEXP})`), (key, { quote }, parser) => _jsx("blockquote", { children: parser.parse(quote.replace(INDENT, ""), "block") }, key), ["block", "list"]);
+export const BLOCKQUOTE_RULE = createMarkupRule(createBlockRegExp(`(?<quote>${PREFIX}${BLOCK_CONTENT_REGEXP})`), (key, { quote }, parser) => {
+    const inner = quote.replace(INDENT, "");
+    // This blockquote is level `depth + 1`; once it reaches the cap, render the (still `>`-prefixed) remainder as
+    // plain text instead of recursing, so nesting stops at exactly MAX_DEPTH levels and can't overflow the stack.
+    if (parser.depth + 1 >= MAX_DEPTH)
+        return _jsx("blockquote", { children: inner }, key);
+    return _jsx("blockquote", { children: parser.nested().parse(inner, "block") }, key);
+}, ["block", "list"]);

package/markup/rule/code.js

@@ -15,4 +15,6 @@ import { BLOCK_CONTENT_REGEXP } from "../util/regexp.js";
  */
 // Priority 10: code is a higher-precedence tier, resolved and masked before links/emphasis, so a
 // code span that straddles a link delimiter wins and the link cannot form across it.
-export const CODE_RULE = createMarkupRule(getRegExp(`(?<fence>\`+)(?<code>${BLOCK_CONTENT_REGEXP})\\k<fence>`), (key, { code }) => _jsx("code", { children: code }, key), ["inline", "list", "link"], 10);
+export const CODE_RULE = createMarkupRule(
+// Fence length is bounded (`{1,64}`) so a long run of backticks can't force O(n²) backtracking against the closing backreference.
+getRegExp(`(?<fence>\`{1,64})(?<code>${BLOCK_CONTENT_REGEXP})\\k<fence>`), (key, { code }) => _jsx("code", { children: code }, key), ["inline", "list", "link"], 10);

package/markup/rule/inline.js

@@ -19,7 +19,10 @@ const INLINE_CHARS = { "~": "del", "+": "ins", "*": "strong", _: "em", "=": "mar
  * @example new MarkupParser({ rules: [INLINE_RULE] }).parse("This is *bold* and _italic_")
  * @see https://shelving.cc/markup/INLINE_RULE
  */
-export const INLINE_RULE = createMarkupRule(createWordRegExp(`(?<wrap>(?<char>[${Object.keys(INLINE_CHARS).join("")}])+)(?<text>(?!\\k<char>)\\S(?:[\\s\\S]*?(?!\\k<char>)\\S)?)\\k<wrap>`), (key, { char, text }, parser) => {
+export const INLINE_RULE = createMarkupRule(createWordRegExp(
+// Marker run is bounded (`{1,8}`) and the inner span is bounded (`{0,2000}?`) so a long run of
+// unclosed markers can't force O(n²) backtracking — real emphasis never approaches these limits.
+`(?<wrap>(?<char>[${Object.keys(INLINE_CHARS).join("")}]){1,8})(?<text>(?!\\k<char>)\\S(?:[\\s\\S]{0,2000}?(?!\\k<char>)\\S)?)\\k<wrap>`), (key, { char, text }, parser) => {
     const Inline = INLINE_CHARS[char];
     return _jsx(Inline, { children: parser.parse(text, "inline") }, key);
 }, ["inline", "list", "link"]);

package/markup/rule/link.js

@@ -30,5 +30,7 @@ _renderLink, ["inline", "list"]);
  * @example new MarkupParser({ rules: [AUTOLINK_RULE] }).parse("http://google.com/maps (Google Maps)")
  * @see https://shelving.cc/markup/AUTOLINK_RULE
  */
-export const AUTOLINK_RULE = createMarkupRule(getRegExp(/(?<href>[a-z]{3,}?:\S+)(?: +(?:\((?<title>[^)\n]*?)\)))?/), //
+export const AUTOLINK_RULE = createMarkupRule(
+// Scheme length is bounded (`{3,64}?`) so a long run of letters with no `:` can't force O(n²) backtracking.
+getRegExp(/(?<href>[a-z]{3,64}?:\S+)(?: +(?:\((?<title>[^)\n]*?)\)))?/), //
 _renderLink, ["inline", "list"]);

package/markup/rule/separator.js

@@ -11,6 +11,8 @@ import { createLineRegExp } from "../util/regexp.js";
  * @example new MarkupParser({ rules: [SEPARATOR_RULE] }).parse("---")
  * @see https://shelving.cc/markup/SEPARATOR_RULE
  */
-export const SEPARATOR_RULE = createMarkupRule(createLineRegExp("([-*•+_=])(?: *\\1){2,}"), //
+export const SEPARATOR_RULE = createMarkupRule(
+// Inter-character whitespace is bounded (`{0,2000}`) so a long run of spaces can't force O(n²) backtracking.
+createLineRegExp("([-*•+_=])(?: {0,2000}\\1){2,}"), //
 //
 key => _jsx("hr", {}, key), ["block"]);

package/markup/rule/table.js

@@ -2,7 +2,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { createMarkupRule } from "../MarkupRule.js";
 import { createBlockRegExp, LINE_SPACE_REGEXP } from "../util/regexp.js";
 // Constants.
-const _SPACE = `${LINE_SPACE_REGEXP}*`; // Run of line whitespace (never crosses a newline).
+const _SPACE = `${LINE_SPACE_REGEXP}{0,2000}`; // Run of line whitespace (never crosses a newline); bounded so a long whitespace line can't force O(n²) backtracking in the delimiter row.
 const _CELL = `${_SPACE}:?-+:?${_SPACE}`; // Delimiter-row cell: one or more dashes with optional `:` alignment markers.
 const _DELIMITER_SOURCE = `${_SPACE}\\|?(?:${_CELL}\\|)+(?:${_CELL})?${_SPACE}`; // Delimiter row: pipe-separated dash cells.
 const _DELIMITER = new RegExp(`^${_DELIMITER_SOURCE}$`, "u"); // Tests whether a single line is a delimiter row.

package/markup/util/regexp.d.ts

@@ -13,12 +13,12 @@ export declare const BLOCK_SPACE_REGEXP = "\\s";
  * Regular expression source matching the start of a block — the start of the string, or one linebreak.
  * @see https://shelving.cc/markup/BLOCK_START_REGEXP
  */
-export declare const BLOCK_START_REGEXP = "(?:\\s*\\n|^)";
+export declare const BLOCK_START_REGEXP = "(?:\\s{0,2000}\\n|^)";
 /**
  * Regular expression source matching the end of a block — the end of the string, or two linebreaks, with trailing whitespace trimmed.
  * @see https://shelving.cc/markup/BLOCK_END_REGEXP
  */
-export declare const BLOCK_END_REGEXP = "\\s*(?:$|\\n\\s*\\n)";
+export declare const BLOCK_END_REGEXP = "\\s{0,2000}(?:$|\\n\\s{0,2000}\\n)";
 /**
  * Regular expression source matching line content — the shortest run of any character except newline.
  * @see https://shelving.cc/markup/LINE_CONTENT_REGEXP
@@ -33,12 +33,12 @@ export declare const LINE_SPACE_REGEXP = "[^\\n\\S]";
  * Regular expression source matching the start of a line — the start of the string, or one linebreak.
  * @see https://shelving.cc/markup/LINE_START_REGEXP
  */
-export declare const LINE_START_REGEXP = "(?:\\s*\\n|^)";
+export declare const LINE_START_REGEXP = "(?:\\s{0,2000}\\n|^)";
 /**
  * Regular expression source matching the end of a line — the end of the string, or one linebreak, with trailing whitespace trimmed.
  * @see https://shelving.cc/markup/LINE_END_REGEXP
  */
-export declare const LINE_END_REGEXP = "[^\\n\\S]*(?:\\s*\\n|$)";
+export declare const LINE_END_REGEXP = "[^\\n\\S]{0,2000}(?:\\s{0,2000}\\n|$)";
 /**
  * Regular expression source matching word content — at least one letter or number character.
  * @see https://shelving.cc/markup/WORD_CONTENT_REGEXP

package/markup/util/regexp.js

@@ -13,12 +13,12 @@ export const BLOCK_SPACE_REGEXP = "\\s"; // Block whitespace (run of any whitesp
  * Regular expression source matching the start of a block — the start of the string, or one linebreak.
  * @see https://shelving.cc/markup/BLOCK_START_REGEXP
  */
-export const BLOCK_START_REGEXP = "(?:\\s*\\n|^)"; // Start of block (start of string, or one linebreak).
+export const BLOCK_START_REGEXP = "(?:\\s{0,2000}\\n|^)"; // Start of block (start of string, or one linebreak). Whitespace is bounded so a long whitespace run can't force O(n²) backtracking at every offset.
 /**
  * Regular expression source matching the end of a block — the end of the string, or two linebreaks, with trailing whitespace trimmed.
  * @see https://shelving.cc/markup/BLOCK_END_REGEXP
  */
-export const BLOCK_END_REGEXP = "\\s*(?:$|\\n\\s*\\n)"; // End of block (end of string, or two linebreaks, trimmed whitespace).
+export const BLOCK_END_REGEXP = "\\s{0,2000}(?:$|\\n\\s{0,2000}\\n)"; // End of block (end of string, or two linebreaks, trimmed whitespace). Whitespace runs bounded to avoid O(n²) backtracking.
 /**
  * Regular expression source matching line content — the shortest run of any character except newline.
  * @see https://shelving.cc/markup/LINE_CONTENT_REGEXP
@@ -38,7 +38,7 @@ export const LINE_START_REGEXP = BLOCK_START_REGEXP; // Start of line (start of
  * Regular expression source matching the end of a line — the end of the string, or one linebreak, with trailing whitespace trimmed.
  * @see https://shelving.cc/markup/LINE_END_REGEXP
  */
-export const LINE_END_REGEXP = `${LINE_SPACE_REGEXP}*(?:\\s*\\n|$)`; // End of line (end of string, or one linebreak, trimmed whitespace).
+export const LINE_END_REGEXP = `${LINE_SPACE_REGEXP}{0,2000}(?:\\s{0,2000}\\n|$)`; // End of line (end of string, or one linebreak, trimmed whitespace). Whitespace runs bounded to avoid O(n²) backtracking.
 /**
  * Regular expression source matching word content — at least one letter or number character.
  * @see https://shelving.cc/markup/WORD_CONTENT_REGEXP

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "shelving",
-	"version": "1.267.3",
+	"version": "1.267.5",
 	"author": "Dave Houlbrooke <dave@shax.com>",
 	"repository": {
 		"type": "git",

package/ui/misc/Markup.d.ts

@@ -14,6 +14,7 @@ export interface MarkupProps extends Partial<MarkupOptions> {
  * - Defaults to `MARKUP_OPTIONS` (full block + inline rule set). Pass `rules`, `rel`, `url`, `root`, or `schemes` as props to override.
  * - `url`/`root` default to the current `<Meta>` context so link rules resolve site-absolute and relative hrefs.
  * - Renders inside whatever ancestor element the caller provides — wrap in `<Prose>` to get the standard prose typography for the produced `<p>` / `<ul>` / `<pre>` / etc.
+ * - **Untrusted input:** when `children` comes from users, cap its length before rendering — parsing is linear for normal content but a few rules can degrade on adversarial input (a sane maximum for your use case, typically tens of kilobytes, bounds worst-case work). See `MarkupParser.parse()`.
  *
  * @param children The source markup string to parse and render (renders `null` when empty).
  * @returns The parsed markup as React nodes, or `null` when `children` is empty.

package/ui/misc/Markup.js

@@ -5,6 +5,7 @@ import { requireMeta } from "./MetaContext.js";
  * - Defaults to `MARKUP_OPTIONS` (full block + inline rule set). Pass `rules`, `rel`, `url`, `root`, or `schemes` as props to override.
  * - `url`/`root` default to the current `<Meta>` context so link rules resolve site-absolute and relative hrefs.
  * - Renders inside whatever ancestor element the caller provides — wrap in `<Prose>` to get the standard prose typography for the produced `<p>` / `<ul>` / `<pre>` / etc.
+ * - **Untrusted input:** when `children` comes from users, cap its length before rendering — parsing is linear for normal content but a few rules can degrade on adversarial input (a sane maximum for your use case, typically tens of kilobytes, bounds worst-case work). See `MarkupParser.parse()`.
  *
  * @param children The source markup string to parse and render (renders `null` when empty).
  * @returns The parsed markup as React nodes, or `null` when `children` is empty.

package/ui/misc/Markup.md

@@ -7,6 +7,7 @@ Parses a markup string and renders the resulting React nodes inline. Defaults to
 - `url` and `root` default to the current `<Meta>` context, so link rules resolve site-absolute and relative hrefs correctly. Override any `MarkupOptions` prop (`rules`, `rel`, `url`, `root`, `schemes`) directly on `<Markup>` for a custom rule set or base URL.
 - Renders `null` when `children` is empty.
 - Wrap in `<Prose>` to give the produced `<p>` / `<ul>` / `<pre>` / etc. the standard prose typography.
+- When `children` comes from users, cap its length before rendering: parsing is linear for normal content, but a few rules can degrade on adversarial input (long backtick runs, deeply-nested `>` blockquotes). A sane maximum for your use case — tens of kilobytes for typical user content — keeps worst-case work bounded.
 
 ## Usage
 

package/ui/misc/Markup.tsx

@@ -17,6 +17,7 @@ export interface MarkupProps extends Partial<MarkupOptions> {
  * - Defaults to `MARKUP_OPTIONS` (full block + inline rule set). Pass `rules`, `rel`, `url`, `root`, or `schemes` as props to override.
  * - `url`/`root` default to the current `<Meta>` context so link rules resolve site-absolute and relative hrefs.
  * - Renders inside whatever ancestor element the caller provides — wrap in `<Prose>` to get the standard prose typography for the produced `<p>` / `<ul>` / `<pre>` / etc.
+ * - **Untrusted input:** when `children` comes from users, cap its length before rendering — parsing is linear for normal content but a few rules can degrade on adversarial input (a sane maximum for your use case, typically tens of kilobytes, bounds worst-case work). See `MarkupParser.parse()`.
  *
  * @param children The source markup string to parse and render (renders `null` when empty).
  * @returns The parsed markup as React nodes, or `null` when `children` is empty.

package/ui/router/Router.js

@@ -37,6 +37,7 @@ function _matchRoute(routes, fallback, meta, path = meta.path, depth = 0) {
         if (typeof Route === "string") {
             if (depth > 10)
                 throw new UnexpectedError("Infinite redirect loop", { received: route, expected: path, caller: _matchRoute });
+            // `placeholders` are already decoded by `matchPathTemplate`, so re-encode them into the redirect path with `renderPathTemplate` — the symmetric partner of the match above.
             return _matchRoute(routes, fallback, meta, renderPathTemplate(Route, placeholders), depth + 1);
         }
         // React element — render as-is.

package/ui/router/Router.tsx

@@ -61,6 +61,7 @@ function _matchRoute(
 		// String value is a redirect; re-run matching with the new path. Guard against infinite redirect loops by limiting depth.
 		if (typeof Route === "string") {
 			if (depth > 10) throw new UnexpectedError("Infinite redirect loop", { received: route, expected: path, caller: _matchRoute });
+			// `placeholders` are already decoded by `matchPathTemplate`, so re-encode them into the redirect path with `renderPathTemplate` — the symmetric partner of the match above.
 			return _matchRoute(routes, fallback, meta, renderPathTemplate(Route, placeholders), depth + 1);
 		}
 

package/ui/tree/TreeMarkup.d.ts

@@ -21,6 +21,7 @@ export declare const TREE_MARKUP_RULES: MarkupRules;
  * - Like `<Markup>` but defaults to `TREE_MARKUP_RULES`, so each backtick span resolves through `TreeLink` against the surrounding `<TreeProvider>` — a known token links to its canonical page, an unknown one stays plain code.
  * - The standard way to render documentation-site content (READMEs, docblocks, per-symbol pages); plain `<Markup>` stays the choice for general user content that shouldn't cross-link.
  * - Falls back to plain code spans outside a `<TreeProvider>`, so it's safe to use anywhere. Pass any `MarkupOptions` prop (including `rules`) to override.
+ * - Inherits `<Markup>`'s input-length guidance: when `children` is untrusted, cap its length before rendering (see `MarkupParser.parse()`).
  *
  * @param children The source markup string to parse and render (renders `null` when empty).
  * @returns The parsed markup as React nodes, or `null` when `children` is empty.

package/ui/tree/TreeMarkup.js

@@ -26,6 +26,7 @@ export const TREE_MARKUP_RULES = MARKUP_RULES.map(rule => (rule === CODE_RULE ?
  * - Like `<Markup>` but defaults to `TREE_MARKUP_RULES`, so each backtick span resolves through `TreeLink` against the surrounding `<TreeProvider>` — a known token links to its canonical page, an unknown one stays plain code.
  * - The standard way to render documentation-site content (READMEs, docblocks, per-symbol pages); plain `<Markup>` stays the choice for general user content that shouldn't cross-link.
  * - Falls back to plain code spans outside a `<TreeProvider>`, so it's safe to use anywhere. Pass any `MarkupOptions` prop (including `rules`) to override.
+ * - Inherits `<Markup>`'s input-length guidance: when `children` is untrusted, cap its length before rendering (see `MarkupParser.parse()`).
  *
  * @param children The source markup string to parse and render (renders `null` when empty).
  * @returns The parsed markup as React nodes, or `null` when `children` is empty.

package/ui/tree/TreeMarkup.md

@@ -7,7 +7,7 @@ Renders a markup string just like `<Markup>`, but auto-links every inline code s
 - Defaults to `TREE_MARKUP_RULES` — the full default rule set with the inline-code rule swapped for `TREE_CODE_RULE`, which renders each span through `TreeLink`.
 - Resolution is exact-match against the tree map: a hit (`` `BooleanSchema` ``, `` `Store.get` ``) links; a miss (`` `bun run fix` ``, `` `string` ``) falls back to a plain code token, so unknown spans never produce a broken link.
 - Falls back to plain code spans outside a `<TreeProvider>`, so it's safe to use anywhere — it simply stops linking.
-- Inherits everything else from `<Markup>`: `url` / `root` default to the current `<Meta>` context, and any `MarkupOptions` prop (`rules`, `rel`, `url`, `root`, `schemes`) can be overridden directly.
+- Inherits everything else from `<Markup>`: `url` / `root` default to the current `<Meta>` context, and any `MarkupOptions` prop (`rules`, `rel`, `url`, `root`, `schemes`) can be overridden directly. That includes the input-length guidance — cap untrusted `children` length before rendering.
 - Wrap in `<Prose>` to give the produced `<p>` / `<ul>` / `<pre>` / etc. the standard prose typography.
 
 ## Usage

package/ui/tree/TreeMarkup.tsx

@@ -30,6 +30,7 @@ export const TREE_MARKUP_RULES: MarkupRules = MARKUP_RULES.map(rule => (rule ===
  * - Like `<Markup>` but defaults to `TREE_MARKUP_RULES`, so each backtick span resolves through `TreeLink` against the surrounding `<TreeProvider>` — a known token links to its canonical page, an unknown one stays plain code.
  * - The standard way to render documentation-site content (READMEs, docblocks, per-symbol pages); plain `<Markup>` stays the choice for general user content that shouldn't cross-link.
  * - Falls back to plain code spans outside a `<TreeProvider>`, so it's safe to use anywhere. Pass any `MarkupOptions` prop (including `rules`) to override.
+ * - Inherits `<Markup>`'s input-length guidance: when `children` is untrusted, cap its length before rendering (see `MarkupParser.parse()`).
  *
  * @param children The source markup string to parse and render (renders `null` when empty).
  * @returns The parsed markup as React nodes, or `null` when `children` is empty.

package/util/template.d.ts

@@ -53,11 +53,13 @@ export declare function matchTemplate(template: string, target: string, caller?:
  * Match a path-shaped template against a target path.
  * - Like `matchTemplate()`, but with `/` segment semantics: non-catchall placeholders cannot span path segments; catchall placeholders can.
  * - A trailing catchall (e.g. `/files/{...path}`) also matches when the trailing separator is absent (e.g. `/files`), with the catchall value as `""`.
+ * - Matched values are **percent-decoded** (the inverse of `renderPathTemplate()`'s encoding), so a round trip is lossless: `matchPathTemplate(t, renderPathTemplate(t, values))` returns the original values. Catchall values keep their `/` separators (each segment is decoded).
+ * - Returns `undefined` if `target` is not validly percent-encoded (e.g. a bare `%` or `%zz`), treating a malformed path as a non-match.
  *
  * @param template The path-shaped template string, e.g. `/users/{name}`.
  * @param target The path containing values, e.g. `/users/Dave`.
  * @param caller Function to attribute a thrown error to (defaults to `matchPathTemplate` itself).
- * @returns An object containing values (e.g. `{ name: "Dave" }`), or `undefined` if no match.
+ * @returns An object containing decoded values (e.g. `{ name: "Dave" }`), or `undefined` if no match.
  * @throws {ValueError} If two template placeholders are not separated by at least one character.
  * @example matchPathTemplate("/users/{name}", "/users/Dave") // { name: "Dave" }
  * @see https://shelving.cc/util/template/matchPathTemplate
@@ -96,14 +98,23 @@ export declare function matchPathTemplates(templates: Iterable<AbsolutePath> & N
  */
 export declare function renderTemplate(template: string, values: TemplateValues, caller?: AnyCaller): string;
 /**
- * Render a path-shaped template. Behaviourally identical to `renderTemplate()` — substitution doesn't need separator awareness — but provided as a sibling to `matchPathTemplate()` so callers can pair them.
+ * Render a path-shaped template, percent-encoding each substituted value so it stays within its path segment.
+ *
+ * Unlike `renderTemplate()`, each placeholder value is run through `encodeURIComponent()` before substitution.
+ * This stops a value that contains `/`, `?`, `#`, `%`, or control characters from escaping its segment and
+ * altering the resolved URL — i.e. path traversal to a different endpoint, or query/fragment injection — when
+ * the result is resolved against a base URL (e.g. by `ClientAPIProvider`). Catchall placeholders (`**`,
+ * `{...path}`, …) legitimately span segments, so each `/`-separated part is encoded but the separators are kept.
+ *
+ * Note: because `encodeURIComponent()` does not encode `.`, a value that is exactly `.` or `..` still renders as
+ * `.`/`..`; callers that treat a placeholder as a trusted single segment should validate against those.
  *
  * @param template The path-shaped template including placeholders, e.g. `/users/{name}`.
  * @param values An object containing values (functions are called, everything else converted to string), or a function or string to use for all placeholders.
  * @param caller Function to attribute a thrown error to (defaults to `renderPathTemplate` itself).
- * @returns The rendered path, e.g. `/users/Dave`.
+ * @returns The rendered path with each value percent-encoded, e.g. `/users/Dave`.
  * @throws {RequiredError} If a placeholder in the template string is not specified in values.
- * @example renderPathTemplate("/users/{name}", { name: "Dave" }) // "/users/Dave"
+ * @example renderPathTemplate("/users/{name}", { name: "a/b" }) // "/users/a%2Fb"
  * @see https://shelving.cc/util/template/renderPathTemplate
  */
 export declare function renderPathTemplate(template: AbsolutePath, values: TemplateValues, caller?: AnyCaller): AbsolutePath;

package/util/template.js

@@ -83,25 +83,40 @@ function _getPlaceholder({ name }) {
  * @see https://shelving.cc/util/template/matchTemplate
  */
 export function matchTemplate(template, target, caller = matchTemplate) {
-    return _matchTemplate(template, target, "", caller);
+    return _matchTemplate(template, target, "", false, caller);
 }
 /**
  * Match a path-shaped template against a target path.
  * - Like `matchTemplate()`, but with `/` segment semantics: non-catchall placeholders cannot span path segments; catchall placeholders can.
  * - A trailing catchall (e.g. `/files/{...path}`) also matches when the trailing separator is absent (e.g. `/files`), with the catchall value as `""`.
+ * - Matched values are **percent-decoded** (the inverse of `renderPathTemplate()`'s encoding), so a round trip is lossless: `matchPathTemplate(t, renderPathTemplate(t, values))` returns the original values. Catchall values keep their `/` separators (each segment is decoded).
+ * - Returns `undefined` if `target` is not validly percent-encoded (e.g. a bare `%` or `%zz`), treating a malformed path as a non-match.
  *
  * @param template The path-shaped template string, e.g. `/users/{name}`.
  * @param target The path containing values, e.g. `/users/Dave`.
  * @param caller Function to attribute a thrown error to (defaults to `matchPathTemplate` itself).
- * @returns An object containing values (e.g. `{ name: "Dave" }`), or `undefined` if no match.
+ * @returns An object containing decoded values (e.g. `{ name: "Dave" }`), or `undefined` if no match.
  * @throws {ValueError} If two template placeholders are not separated by at least one character.
  * @example matchPathTemplate("/users/{name}", "/users/Dave") // { name: "Dave" }
  * @see https://shelving.cc/util/template/matchPathTemplate
  */
 export function matchPathTemplate(template, target, caller = matchPathTemplate) {
-    return _matchTemplate(template, target, "/", caller);
+    return _matchTemplate(template, target, "/", true, caller);
 }
-function _matchTemplate(template, target, separator, caller) {
+/**
+ * Decode a matched path value — the inverse of `renderPathTemplate()`'s `encodeURIComponent`.
+ * - Catchall values keep their `/` separators (each segment is decoded independently, mirroring the per-segment encode).
+ * - Returns `undefined` for malformed percent-encoding (e.g. a bare `%` or `%zz`), so the caller can reject the whole match.
+ */
+function _decodePathValue(value, catchall) {
+    try {
+        return catchall ? value.split("/").map(decodeURIComponent).join("/") : decodeURIComponent(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function _matchTemplate(template, target, separator, decode, caller) {
     // Get separators and placeholders from template.
     const chunks = _splitTemplateCached(template, caller);
     const firstChunk = chunks[0];
@@ -134,7 +149,18 @@ function _matchTemplate(template, target, separator, caller) {
             if (separator && value.includes(separator))
                 return undefined; // Non-catchall placeholders can't span separators (when one is configured).
         }
-        values[name] = value;
+        // In path mode, percent-decode the (still-encoded) value so it round-trips with `renderPathTemplate()`; a
+        // malformed encoding rejects the whole match. The separator check above runs on the encoded value first,
+        // so an encoded `%2F` can't smuggle a separator into a non-catchall segment.
+        if (decode) {
+            const decoded = _decodePathValue(value, catchall);
+            if (decoded === undefined)
+                return undefined;
+            values[name] = decoded;
+        }
+        else {
+            values[name] = value;
+        }
         startIndex = stopIndex + post.length;
     }
     if (startIndex < target.length)
@@ -219,16 +245,48 @@ export function renderTemplate(template, values, caller = renderTemplate) {
     return output;
 }
 /**
- * Render a path-shaped template. Behaviourally identical to `renderTemplate()` — substitution doesn't need separator awareness — but provided as a sibling to `matchPathTemplate()` so callers can pair them.
+ * Render a path-shaped template, percent-encoding each substituted value so it stays within its path segment.
+ *
+ * Unlike `renderTemplate()`, each placeholder value is run through `encodeURIComponent()` before substitution.
+ * This stops a value that contains `/`, `?`, `#`, `%`, or control characters from escaping its segment and
+ * altering the resolved URL — i.e. path traversal to a different endpoint, or query/fragment injection — when
+ * the result is resolved against a base URL (e.g. by `ClientAPIProvider`). Catchall placeholders (`**`,
+ * `{...path}`, …) legitimately span segments, so each `/`-separated part is encoded but the separators are kept.
+ *
+ * Note: because `encodeURIComponent()` does not encode `.`, a value that is exactly `.` or `..` still renders as
+ * `.`/`..`; callers that treat a placeholder as a trusted single segment should validate against those.
  *
  * @param template The path-shaped template including placeholders, e.g. `/users/{name}`.
  * @param values An object containing values (functions are called, everything else converted to string), or a function or string to use for all placeholders.
  * @param caller Function to attribute a thrown error to (defaults to `renderPathTemplate` itself).
- * @returns The rendered path, e.g. `/users/Dave`.
+ * @returns The rendered path with each value percent-encoded, e.g. `/users/Dave`.
  * @throws {RequiredError} If a placeholder in the template string is not specified in values.
- * @example renderPathTemplate("/users/{name}", { name: "Dave" }) // "/users/Dave"
+ * @example renderPathTemplate("/users/{name}", { name: "a/b" }) // "/users/a%2Fb"
  * @see https://shelving.cc/util/template/renderPathTemplate
  */
 export function renderPathTemplate(template, values, caller = renderPathTemplate) {
-    return renderTemplate(template, values, caller);
+    const chunks = _splitTemplateCached(template, caller);
+    if (!chunks.length)
+        return template;
+    let output = template;
+    for (const { name, placeholder, catchall } of chunks) {
+        const value = _getTemplateValue(values, name, caller);
+        const encoded = catchall ? value.split("/").map(encodeURIComponent).join("/") : encodeURIComponent(value);
+        // Use a replacer function so `$` sequences in the (already-encoded) value are never treated as special replacement patterns.
+        output = output.replace(placeholder, () => encoded);
+    }
+    return output;
+}
+/** Resolve the string value for a single template placeholder from `TemplateValues` (mirrors `renderTemplate()`'s per-name resolution). */
+function _getTemplateValue(values, name, caller) {
+    const value = isFunction(values)
+        ? values(name)
+        : isData(values)
+            ? getString(getDataProp(values, name))
+            : isArray(values)
+                ? getString(values[Number(name)])
+                : getString(values);
+    if (value === undefined)
+        throw new RequiredError(`Template placeholder "${name}" not found`, { received: values, name, caller });
+    return value;
 }