bluesky_text

feat: Entity.toFacet, Entities.toFacetsResult and Entities.toFacets accept an optional http.Client? client, forwarded to the built-in handle-resolution call. It is used only when no resolver is supplied and exists so the default (network) mention path can be driven against a mock transport. Existing callers are unaffected — the parameter is optional and additive.

test: the mention-facet tests no longer reach the live network. Seven tests resolved real handles against bsky.social and asserted the returned DID, so they broke on any outage, rate limit, or handle change and could not run offline. They now inject a MockClient (via the new client hook) that answers resolveHandle locally, covering the success path, the 4xx "unresolvable handle → no facet" swallow, the 5xx "surface the error" rethrow, and that service reaches the request. One meaningless "does not throw" assertion was replaced with a real output check.

security: isLinkFacade no longer passes a display text it cannot parse. It used to return false — "not a facade" — both when the text named no host and when it named one that could not be read, so every shape the parser did not recognize went through unflagged.

• Display text is now folded the way IDNA (UTS-46) folds it before comparison: the three full-stop variants (。 U+3002, ． U+FF0E, ｡ U+FF61) become ., and the fullwidth ASCII block (U+FF01–U+FF5E) becomes plain ASCII. bsky。app and ｂｓｋｙ．ａｐｐ are hosts a browser really resolves to bsky.app — the reader sees a domain they trust and the link works — and they were not flagged when pointed at another host. The host of the target is folded the same way, so a link written with a fullwidth host still matches an ASCII display text. This is not homograph detection, which stays out of scope: only the characters IDNA maps onto ASCII are folded, and a Cyrillic look-alike is still a genuinely different host.
• The authority now ends at a backslash as well as at /, ? and #. The WHATWG URL Standard makes \ a synonym for / in a special scheme, so a browser reads the host of https://bsky.app\@evil.example.com as bsky.app; that went unflagged while its https://bsky.app\evil.example.com sibling was flagged.
• Wrappers and sentence punctuation are stripped from both ends, and a leading // is read as a protocol-relative reference. "bsky.app", <bsky.app>, (bsky.app), //bsky.app and bsky.app, were all unflagged while bsky.app/ and [bsky.app] were flagged.

feat: added checkLinkFacade and LinkFacadeVerdict, which report facade, honest, notAUrl or undetermined instead of the single boolean. undetermined is the case a boolean cannot express — the display text reads as a URL but yields no host, it is host-shaped under an internationalized TLD this package carries no data for, or the link itself has no host to compare against. isLinkFacade is unchanged and is now checkLinkFacade(...) == LinkFacadeVerdict.facade.

fix: PostFacet.fromJson refuses malformed JSON instead of leaking a _TypeError out of the render path. A facet with no index, an index that is not an object, a byteStart/byteEnd that is not a whole number, or a features that is not a list now throws a FormatException naming the field; a feature entry that is not an object is skipped, exactly as an unknown $type already was, and a whole-numbered double offset such as 2.0 is accepted. Added PostFacet.tryFromJson, which returns null where fromJson throws, so one bad facet in a fetched post drops out instead of taking the whole render down.

perf: extracting entities is no longer quadratic in the length of a run of dotted labels or of a path of balanced parens. A run with no usable TLD was rescanned once per label, with the TLD alternation — thousands of literals wide — as the constant, and a path was matched against a star over an alternation that retried every prefix. 'a.' * 150, a legal 300-character post, took 43 ms and now takes 0.13 ms; 3000 characters took 11 s and now take 1.3 ms; https://a.com/ followed by 3000 (a) groups took 4.9 s and now takes 0.5 ms. Ordinary text is unaffected in either direction. Extraction is unchanged to the entity: the same facets come out of the existing suite and of a 10,344-entry corpus of real and generated posts, and the skip stands down entirely on any text where it could have changed an answer.

• The boundary always lands on a grapheme cluster boundary, so emoji and other multi-code-unit characters are never split.
• When the boundary would fall inside an entity (handle, link, tag, cashtag or markdown link) it is snapped back to that entity's start, so the entity is treated atomically — wholly within the limit or wholly in the overflow.
• Because the range is derived from the value, calling .format().overflow reports the overflow of the formatted text (markdown expanded, links shortened), which is what is displayed and posted.

• The mention regex is now case-insensitive, so @Alice.Bsky.Social and @SHINYAKATO.DEV are detected.
• The hashtag "emoji" character class was rewritten to drop whitespace, U+3000, line separators, CJK punctuation, and lone surrogate ranges, so #タグ　こんにちは is one tag and #tag3　#tag4 are both preserved.
• Tag facet values strip a single leading #, and the tag length limit is now 64 graphemes (excluding #), matching the spec.
• Mention preceding-character rules follow the official (^|\s|\() boundary (the leftover twitter-text RT: alternative is removed).
• Full-width ＃ is now recognized as a hashtag sign (partial; #tag1#tag2 splitting is still deferred).

• The ticker symbol is limited to 1–5 ASCII characters ([A-Za-z][A-Za-z0-9]{0,4}); longer candidates like $GOOGLE are rejected.
• A cashtag must be preceded by a leading boundary — the start of the string, a whitespace character (including U+3000 / U+00A0), or an ASCII ( — and followed by a trailing boundary — whitespace, the end of the string, or one of the ASCII punctuation characters . , ; : ! ? ) " ' or ’ (U+2019). As a result, cashtags glued to Japanese (or other non-delimiting) text such as 日本株$AAPL or $AAPLです are intentionally not detected, matching the official Bluesky behavior. Full-width delimiters like （$AAPL） and $AAPL。 are likewise not treated as boundaries.
• The ticker is normalized to upper case and the emitted tag facet keeps the leading $ (e.g. $aapl → $AAPL), mirroring the official cashtag facet.

• New BlueskyText.cashtags getter returns all cashtag entities along with their byte indices.
• New EntityType.cashtag and Entity.isCashtag for type-safe handling.
• Cashtags are also surfaced from BlueskyText.entities alongside handles, links, and hashtags.
• Cashtags are converted to app.bsky.richtext.facet#tag features when calling toFacets(), mirroring how Bluesky represents tag-like facets.
• Symbols must start with an ASCII letter and may contain ASCII letters or digits afterwards. Bare dollar amounts like $1000 are not detected as cashtags.

• Full-width space (U+3000) and other Unicode space characters are now recognized as valid hashtag boundaries
• Improved compatibility with Bluesky's official client behavior
• Enhanced hashtag recognition for international users, especially Japanese users

• Added extensive tests for hashtags, handles, and links with real-world scenarios
• Added security tests to prevent Unicode normalization attacks and ReDoS vulnerabilities
• Added performance tests with large numbers of entities
• Added multilingual support tests for various languages
• Added boundary detection tests for edge cases

• Ideographic space (U+3000) - commonly used in Japanese text
• No-break space (U+00A0) - commonly used in HTML
• Regular space (U+0020) - standard ASCII space

• Also added EntityType.markdownLink. If you want to exclude entities in the markdown without being .format, you can filter by this fixed value.

• .hasHandle
• .hasNotHandle
• .hasLink
• .hasNotLink
• .hasEntity
• .hasNotEntity