@ai-matrx/content-ir 0.14.3 → 0.15.0

package/CHANGELOG.md

@@ -6,6 +6,44 @@ Automatic changed-only republish (docs/metadata drift since the last tag — see
 `git diff npm/content-ir-core/v0.14.2..npm/content-ir-core/v0.14.3 -- apps/shared/content-ir-core`).
 No source changes intended and no consumer action required.
 
+## 0.15.0 — 2026-09-25
+
+**`/source` — the attack suite stands alone; the last twin drift and flicker
+closed** (verify-RC-B3 § Re-verification (0.14.2): G1–G3, R4′, R2′). Proof:
+the verifier's six planted mutations (M1 skip the in-range island check, M2
+integrity default off, M3 streaming ignored, M4 code-point offset off by one,
+M5 unbounded `}}` scan, M6 `islandEdit` accepts any span) each turn
+`__tests__/source-attack.test.ts` red ON ITS OWN; unmutated code is green in
+CI and in four consecutive `SOURCE_ATTACK=long` runs on a heavily loaded host.
+
+- **G1** — the streaming check covers every complete island in every prefix,
+  the LAST one included, keyed by span AND block/inline; only line-grown
+  constructs (tree, callout, footnote, HTML block, directive) may grow as the
+  trailing block. A third message carries the R2′ case and the extended syntax.
+- **G2** — save verdicts are checked against an independent oracle (which
+  islands survive in the expected text), exactly: `island_edit` vs
+  `integrity` vs accepted; two-sided edits must map an island exactly (never
+  through a deleted range); mangling must be `island_edit`; forged
+  `island:true` spans must be `misaligned`.
+- **G3** — timing compares the MINIMUM of interleaved runs at a 4× size step
+  (linear ≈ 4×, quadratic ≈ 16×, bound 8×) and fails only if every one of
+  three attempts breaches.
+- **`island_edit` is now also the verdict** when an island inside the edited
+  range survives only as ordinary text (its bytes matched a non-island copy,
+  or the edit turned it into code) — previously reported as `integrity`.
+  `integrity` now means an island OUTSIDE the edited ranges was disturbed.
+- **R2′** — streaming: a `$$` block whose closer sits on the still-open last
+  line is not settled (the rest of that line decides block vs inline); a
+  closing `$` that is the last byte so far is not yet math.
+- **R4′** — `FENCE_OPENER_WHITESPACE` + `parseFenceOpener`: the opener parse
+  (JavaScript `trim()` / `/\s/`, written out — proven equal to `/\s/` over
+  every BMP code point) shared with the Python twin, whose block detector now
+  reads `markdown\u001f` as the renderer does. Vectors gained an `openers`
+  section and four exotic-whitespace documents (old Python: red).
+
+**Consumer action:** code that branches on `SourceSpliceError.code` treats a
+carried island that no longer stands as `island_edit` (it was `integrity`).
+
 ## 0.14.2 — 2026-09-25
 
 **`/source` — a tilde fence locks what the renderer draws inside it**

package/dist/index.cjs

@@ -5195,6 +5195,24 @@ function trimFenceLine(line) {
   while (end > start && isFenceWhitespace(line[end - 1])) end--;
   return start === 0 && end === line.length ? line : line.slice(start, end);
 }
+var FENCE_OPENER_WHITESPACE = "	\n\v\f\r \xA0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200A\u2028\u2029\u202F\u205F\u3000\uFEFF";
+function isOpenerWhitespace(ch) {
+  return ch !== void 0 && ch !== "" && FENCE_OPENER_WHITESPACE.includes(ch);
+}
+function parseFenceOpener(line) {
+  let start = 0;
+  let end = line.length;
+  while (start < end && isOpenerWhitespace(line[start])) start++;
+  while (end > start && isOpenerWhitespace(line[end - 1])) end--;
+  let ticks = 0;
+  while (start + ticks < end && line[start + ticks] === "`") ticks++;
+  if (ticks < 3) return null;
+  let infoStart = start + ticks;
+  while (infoStart < end && isOpenerWhitespace(line[infoStart])) infoStart++;
+  let langEnd = infoStart;
+  while (langEnd < end && !isOpenerWhitespace(line[langEnd])) langEnd++;
+  return { ticks, lang: line.slice(infoStart, langEnd) };
+}
 function classifyInnerFenceLine(trimmed, openTicks, nests, nestedDepth) {
   let ticks = 0;
   while (ticks < trimmed.length && trimmed[ticks] === "`") ticks++;
@@ -5955,8 +5973,7 @@ var Tokenizer = class {
    */
   backtickFence(p, li, t) {
     const openTicks = backtickRunLength(t, 0);
-    const info = t.slice(openTicks).trim();
-    const lang = info.split(/\s/)[0] ?? "";
+    const lang = parseFenceOpener(t)?.lang ?? "";
     const isJson = lang === "json";
     const normalized = normalizeFenceLanguage(lang);
     const meta = { fence: "`", ticks: openTicks, lang };
@@ -6086,6 +6103,7 @@ var Tokenizer = class {
     const endLine = this.lineOf(close);
     const endCe = this.contentEnds[endLine];
     if (endLine !== li && !this.isBlank(end, endCe)) return null;
+    if (this.isOpenTail(endLine)) return this.island("math_block", p, this.n, false, { delimiter: "$$" });
     return this.island("math_block", p, end, true, { delimiter: "$$" });
   }
   /** `<artifact …>`, `<decision …>`, … at the start of a line. */
@@ -6415,7 +6433,7 @@ var Tokenizer = class {
           continue;
         }
         const end = singleDollarMathEnd(text, i, pe);
-        if (end > 0) {
+        if (end > 0 && !(this.streaming && end === this.n)) {
           inlines.push(this.island("math_inline", i, end, true, { delimiter: "$" }));
           i = end;
           continue;
@@ -6825,11 +6843,17 @@ function spliceSave(original, edits, options = {}) {
     else newIslandsByStart.set(island.start, [island.raw]);
   }
   const disturbed = [];
+  const carried = (island) => sorted.some((edit) => !edit.island && island.start >= edit.start && island.end <= edit.end);
+  const changedInside = [];
   for (const island of islands) {
     if (replacedIslands.has(`${island.start}:${island.end}`)) continue;
     const mappedStart = mapPosition(changes, island.start, { assoc: 1 }).pos;
     const candidates = newIslandsByStart.get(mappedStart);
     if (!candidates || !candidates.includes(island.raw)) {
+      if (carried(island)) {
+        changedInside.push(island);
+        continue;
+      }
       disturbed.push({
         islandType: island.islandType,
         inline: island.inline,
@@ -6839,6 +6863,14 @@ function spliceSave(original, edits, options = {}) {
       });
     }
   }
+  if (changedInside.length > 0) {
+    const first = changedInside[0];
+    const name = first.meta.tag ?? first.meta.name ?? first.meta.lang ?? "";
+    throw new SourceSpliceError(
+      "island_edit",
+      `the edit changes the protected ${first.islandType}${name ? ` (${String(name)})` : ""} island at [${first.start}, ${first.end}) \u2014 its bytes survive only as ordinary text${changedInside.length > 1 ? ` (and ${changedInside.length - 1} more)` : ""}; islands change only through islandEdit()`
+    );
+  }
   const integrity = {
     ok: bytesOutsideEditsIdentical && disturbed.length === 0,
     bytesOutsideEditsIdentical,
@@ -6896,6 +6928,7 @@ exports.CAPABILITY_BY_CLASS = CAPABILITY_BY_CLASS;
 exports.CLASSES = CLASSES;
 exports.DIRECTIVE_VERSION = DIRECTIVE_VERSION;
 exports.DirectiveDecodeError = DirectiveDecodeError;
+exports.FENCE_OPENER_WHITESPACE = FENCE_OPENER_WHITESPACE;
 exports.FENCE_WHITESPACE = FENCE_WHITESPACE;
 exports.IN_CONTENT_CLASSES = IN_CONTENT_CLASSES;
 exports.IR_ENVELOPE_CACHE_VERSION = IR_ENVELOPE_CACHE_VERSION;
@@ -6998,6 +7031,7 @@ exports.nounTitleColumn = nounTitleColumn;
 exports.openParseSession = openParseSession;
 exports.pairDisplayMath = pairDisplayMath;
 exports.parseDirectiveSlug = parseDirectiveSlug;
+exports.parseFenceOpener = parseFenceOpener;
 exports.readEnvelope = readEnvelope;
 exports.readNodeOutcomeValue = readNodeOutcomeValue;
 exports.readObjectKind = readObjectKind;