@brianmsm/quarto-bento 0.0.0-stage → 0.1.1

package/distribution/runtime/src/source/code-language.ts

@@ -0,0 +1,277 @@
+import {
+  hashSource,
+  scanSource,
+  type SourceDocument,
+  SourceError,
+  type SourcePatch,
+} from "./mod.ts";
+import {
+  originalAttributeTokens,
+  originalPandocAttributes,
+} from "./attributes.ts";
+/** Exact built-in selector IDs at Bento pin 3d6f7f1fcdf2308e875345ce4f1e0ec0820c914b; no inferred aliases. */
+export const DISPLAYED_CODE_LANGUAGES = [
+  "js",
+  "ts",
+  "py",
+  "rust",
+  "go",
+  "java",
+  "sh",
+  "sql",
+  "c",
+  "cpp",
+  "csharp",
+  "kotlin",
+  "swift",
+  "scala",
+  "dart",
+  "zig",
+  "php",
+  "ruby",
+  "perl",
+  "lua",
+  "r",
+  "julia",
+  "powershell",
+  "haskell",
+  "elixir",
+  "erlang",
+  "clojure",
+  "ocaml",
+  "fsharp",
+  "json",
+  "yaml",
+  "toml",
+  "ini",
+  "xml",
+  "html",
+  "css",
+  "graphql",
+  "proto",
+  "dockerfile",
+  "makefile",
+  "asm",
+  "elm",
+  "nim",
+  "crystal",
+  "solidity",
+  "hcl",
+  "nix",
+  "matlab",
+  "fortran",
+  "pascal",
+  "groovy",
+  "verilog",
+  "vhdl",
+  "latex",
+  "objc",
+  "scheme",
+  "lisp",
+  "prolog",
+  "ada",
+  "d",
+  "gleam",
+  "batch",
+  "awk",
+  "tcl",
+  "vb",
+  "scss",
+  "nginx",
+  "jinja",
+  "sparql",
+  "cypher",
+  "fish",
+  "apex",
+  "purescript",
+  "odin",
+  "zsh",
+  "diff",
+  "md",
+] as const;
+export interface CodeLanguageRequest {
+  blockId: string;
+  expected: string | null;
+  language: string | null;
+}
+export interface CodeLanguagePreview {
+  version: 1;
+  kind: "displayed-code-language";
+  sourceHash: string;
+  requests: CodeLanguageRequest[];
+  patches: SourcePatch[];
+  result: string;
+  resultHash: string;
+}
+function fail(message: string): never {
+  throw new SourceError("unsupported-code-language", message);
+}
+export function checkedCodeLanguage(value: unknown): string | null {
+  if (value === null) return null;
+  if (
+    typeof value !== "string" ||
+    !DISPLAYED_CODE_LANGUAGES.includes(
+      value as typeof DISPLAYED_CODE_LANGUAGES[number],
+    )
+  ) {
+    fail(
+      "Select an exact built-in Bento language ID, or remove the language; executable syntax and unknown aliases are unsupported.",
+    );
+  }
+  return value;
+}
+export function codeLanguageSyntax(raw: string) {
+  const line = raw.split(/\r?\n/)[0],
+    fence = /^ {0,3}(`{3,}|~{3,})([ \t]*)(.*?)([ \t]*)$/.exec(line);
+  if (!fence) {
+    fail("Displayed code requires one exact original non-executable fence.");
+  }
+  const prefix = line.indexOf(fence[1]) + fence[1].length + fence[2].length,
+    info = fence[3];
+  if (info.startsWith("{")) {
+    if (!/^\{[^{}]*\}$/.test(info)) {
+      fail("Executable/raw/nested fence syntax cannot change language.");
+    }
+    const content = info.slice(1, -1),
+      tokens = originalAttributeTokens(content),
+      attr = originalPandocAttributes(content, tokens);
+    if (attr[1].length > 1) {
+      fail("Displayed code must have at most one original language class.");
+    }
+    const token = tokens.find((t) => !t.key && content[t.start] === ".");
+    return {
+      grammar: attr[1][0] ?? null,
+      start: prefix + 1 + (token?.start ?? content.length),
+      end: prefix + 1 + (token?.end ?? content.length),
+      attribute: true,
+    };
+  }
+  if (/[\s{}]/.test(info)) {
+    fail("Plain displayed fences require one literal language token.");
+  }
+  return {
+    grammar: info || null,
+    start: prefix,
+    end: prefix + info.length,
+    attribute: false,
+  };
+}
+const encoder = new TextEncoder(),
+  decoder = new TextDecoder("utf-8", { fatal: true });
+function splice(text: string, patches: SourcePatch[]) {
+  let bytes = encoder.encode(text);
+  for (const p of [...patches].sort((a, b) => b.span.start - a.span.start)) {
+    if (
+      decoder.decode(bytes.subarray(p.span.start, p.span.end)) !== p.expected
+    ) throw new SourceError("stale-fragment", p.blockId);
+    const replacement = encoder.encode(p.replacement),
+      next = new Uint8Array(
+        bytes.length - p.span.end + p.span.start + replacement.length,
+      );
+    next.set(bytes.subarray(0, p.span.start));
+    next.set(replacement, p.span.start);
+    next.set(bytes.subarray(p.span.end), p.span.start + replacement.length);
+    bytes = next;
+  }
+  return decoder.decode(bytes);
+}
+export function previewCodeLanguages(
+  doc: SourceDocument,
+  requests: CodeLanguageRequest[],
+): CodeLanguagePreview {
+  if (hashSource(doc.text) !== doc.hash) {
+    throw new SourceError("stale-document", "Source snapshot changed.");
+  }
+  const seen = new Set<string>(), patches: SourcePatch[] = [];
+  for (const r of requests) {
+    if (
+      !r || Object.keys(r).sort().join(",") !== "blockId,expected,language" ||
+      typeof r.blockId !== "string" ||
+      !(r.expected === null || typeof r.expected === "string") ||
+      seen.has(r.blockId)
+    ) fail("Malformed or duplicate code language request.");
+    seen.add(r.blockId);
+    checkedCodeLanguage(r.language);
+    const blocks = doc.blocks.filter((b) => b.id === r.blockId), b = blocks[0];
+    if (
+      blocks.length !== 1 || b.kind !== "code" || b.origin !== "authored" ||
+      !b.editable
+    ) fail("Language sync is limited to one authored non-executable fence.");
+    const syntax = codeLanguageSyntax(b.raw);
+    if (syntax.grammar !== r.expected) {
+      throw new SourceError(
+        "source-conflict",
+        "Original displayed language changed; recalculate before reviewing.",
+      );
+    }
+    const line = b.raw.split(/\r?\n/)[0],
+      expected = line.slice(syntax.start, syntax.end),
+      replacement = r.language === null
+        ? ""
+        : syntax.attribute
+        ? (syntax.grammar ? "." + r.language : " ." + r.language)
+        : r.language;
+    const start = b.span.start +
+        encoder.encode(line.slice(0, syntax.start)).length,
+      end = b.span.start + encoder.encode(line.slice(0, syntax.end)).length;
+    patches.push({
+      blockId: b.id,
+      span: { start, end },
+      expected,
+      replacement,
+    });
+  }
+  const result = splice(doc.text, patches), fresh = scanSource(result);
+  const shape = (d: SourceDocument) =>
+    d.blocks.map(
+      (b) => [
+        b.kind,
+        b.explicitId,
+        b.level,
+        b.origin,
+        b.kind === "div" ? null : b.content,
+      ],
+    );
+  if (
+    JSON.stringify(shape(doc)) !== JSON.stringify(shape(fresh)) ||
+    fresh.diagnostics.length
+  ) {
+    fail(
+      "Language edit changed source body, identity or execution boundaries.",
+    );
+  }
+  for (const r of requests) {
+    const b = fresh.blocks.find((b) => b.id === r.blockId);
+    if (!b || codeLanguageSyntax(b.raw).grammar !== r.language) {
+      fail("Language does not round-trip exactly.");
+    }
+  }
+  return {
+    version: 1,
+    kind: "displayed-code-language",
+    sourceHash: doc.hash,
+    requests: structuredClone(requests),
+    patches,
+    result,
+    resultHash: hashSource(result),
+  };
+}
+export function applyCodeLanguages(text: string, preview: CodeLanguagePreview) {
+  if (
+    preview.version !== 1 || preview.kind !== "displayed-code-language" ||
+    hashSource(text) !== preview.sourceHash
+  ) {
+    throw new SourceError(
+      "stale-source",
+      "Review the current code language patch.",
+    );
+  }
+  const verified = previewCodeLanguages(scanSource(text), preview.requests);
+  if (JSON.stringify(verified) !== JSON.stringify(preview)) {
+    throw new SourceError(
+      "invalid-preview",
+      "Code language preview changed after review.",
+    );
+  }
+  return verified.result;
+}

package/distribution/runtime/src/source/component-insertion.ts

@@ -0,0 +1,160 @@
+/** Bounded component source; no design geometry, source execution or inferred roles. */
+import { scanSource, type SourceDocument, SourceError } from "./mod.ts";
+import { kpiSource } from "./kpi.ts";
+export interface ComponentInsertion {
+  type: "insert-component";
+  kind: "card" | "kpi";
+  slideId: string;
+  id: string;
+  fields: {
+    role: "title" | "body" | "label" | "value" | "detail";
+    sourceId: string;
+    markdown: string;
+  }[];
+}
+function fail(message: string): never {
+  throw new SourceError("invalid-component-insertion", message);
+}
+export function componentMarkdown(operation: ComponentInsertion): string {
+  const keys = (value: object, expected: string[]) =>
+    Object.keys(value).length === expected.length &&
+    expected.every((key) => Object.hasOwn(value, key));
+  if (
+    !operation ||
+    !keys(operation, ["type", "kind", "slideId", "id", "fields"]) ||
+    operation.type !== "insert-component" ||
+    !["card", "kpi"].includes(operation.kind) ||
+    !/^[A-Za-z][\w:.-]{0,119}$/.test(operation.id) ||
+    typeof operation.slideId !== "string" || !Array.isArray(operation.fields)
+  ) fail("Use one explicit identified card or KPI with exact authored roles.");
+  const roles = operation.kind === "card"
+    ? ["title", "body"]
+    : ["label", "value", ...(operation.fields.length === 3 ? ["detail"] : [])];
+  if (operation.fields.length !== roles.length) {
+    fail("Use title/body or label/value/optional detail in that order.");
+  }
+  const pieces = [`:::: {#${operation.id} .bento-${operation.kind}}`];
+  for (const [index, field] of operation.fields.entries()) {
+    if (
+      !field || !keys(field, ["role", "sourceId", "markdown"]) ||
+      field.role !== roles[index] ||
+      field.sourceId !== `${operation.id}-${field.role}` ||
+      typeof field.markdown !== "string" || !field.markdown.trim() ||
+      field.markdown.length > 12000
+    ) {
+      fail(
+        "Each authored field needs its explicit role and reserved source identity.",
+      );
+    }
+    const markdown = field.markdown.replace(/\r\n|\r/g, "\n"),
+      parsed = scanSource(markdown),
+      block = parsed.blocks[0];
+    if (
+      parsed.diagnostics.length || parsed.blocks.length !== 1 ||
+      block.kind !== "paragraph" || !block.editable ||
+      block.origin !== "authored" || block.explicitId || block.parentId ||
+      block.content !== markdown || /<!--|-->|\{\{[<%]|\$\$|\\\[/.test(markdown)
+    ) {
+      fail(
+        "Fields must be one complete authored paragraph, with no structural, computed or display-math syntax.",
+      );
+    }
+    if (field.role === "title") {
+      if (/[\r\n]/.test(markdown)) fail("A card title must be a single line.");
+      pieces.push(`### ${markdown} {#${field.sourceId}}`);
+    } else {
+      pieces.push(
+        `::: {#${field.sourceId}${
+          operation.kind === "kpi" ? ` bento-role="${field.role}"` : ""
+        }}\n${markdown}\n:::`,
+      );
+    }
+  }
+  pieces.push("::::");
+  const result = pieces.join("\n\n") + "\n\n", parsed = scanSource(result);
+  if (
+    parsed.diagnostics.length ||
+    parsed.blocks.some((block) => block.origin !== "authored")
+  ) fail("Component fields introduced unsupported syntax.");
+  if (operation.kind === "kpi") kpiSource(parsed, operation.id);
+  else {
+    const direct = parsed.blocks.filter((block) =>
+      block.parentId === operation.id
+    );
+    if (
+      direct.length !== 2 || direct[0].kind !== "heading" ||
+      direct[0].level !== 3 || direct[0].id !== `${operation.id}-title` ||
+      direct[0].content !== operation.fields[0].markdown ||
+      direct[1].kind !== "div" || direct[1].id !== `${operation.id}-body`
+    ) fail("Card title/body must preserve exact source roles.");
+    const body = parsed.blocks.filter((block) =>
+      block.parentId === direct[1].id
+    );
+    if (
+      body.length !== 1 || body[0].kind !== "paragraph" ||
+      body[0].id !== `${direct[1].id}/paragraph:1`
+    ) fail("Card body must preserve one source paragraph.");
+  }
+  return result;
+}
+export function generatedComponent(
+  source: SourceDocument,
+  operation: ComponentInsertion,
+): string {
+  const section = componentMarkdown(operation),
+    existing = new Set(source.blocks.map((block) => block.id));
+  for (const block of scanSource(section).blocks) {
+    if (existing.has(block.id)) {
+      throw new SourceError(
+        "duplicate-id",
+        `Source identity ${block.id} already exists.`,
+      );
+    }
+  }
+  return section.replace(/\n/g, source.newline);
+}
+export function verifyComponentInsertion(
+  before: SourceDocument,
+  after: SourceDocument,
+  operation: ComponentInsertion,
+): void {
+  const expected = scanSource(componentMarkdown(operation)),
+    ids = new Set(expected.blocks.map((block) => block.id));
+  const added = after.blocks.filter((block) => ids.has(block.id));
+  const semantic = (blocks: SourceDocument["blocks"]) =>
+    blocks.map((
+      block,
+    ) => [
+      block.id,
+      block.kind,
+      block.origin,
+      block.parentId,
+      block.content.replace(/\r\n/g, "\n"),
+      block.level,
+    ]);
+  if (
+    JSON.stringify(semantic(added)) !==
+      JSON.stringify(semantic(expected.blocks)) ||
+    added.some((block) => block.slideId !== operation.slideId) ||
+    JSON.stringify(before.slides.map((slide) => [slide.id, slide.stable])) !==
+      JSON.stringify(after.slides.map((slide) => [slide.id, slide.stable]))
+  ) {
+    fail(
+      "Insertion must preserve exact component roles and existing slide boundaries.",
+    );
+  }
+  const prior = (blocks: SourceDocument["blocks"]) =>
+    blocks.map((
+      block,
+    ) => [
+      block.kind,
+      block.raw.replace(/\r?\n$/, ""),
+      block.origin,
+      block.level,
+      block.slideId,
+    ]);
+  if (
+    JSON.stringify(prior(before.blocks)) !==
+      JSON.stringify(prior(after.blocks.filter((block) => !ids.has(block.id))))
+  ) fail("Insertion changed existing source bytes or block boundaries.");
+}

package/distribution/runtime/src/source/deletion.ts

@@ -0,0 +1,278 @@
+/** Exact removal of one independently authored source unit, without container inference. */
+import {
+  sliceBytes,
+  type SourceBlock,
+  type SourceDocument,
+  SourceError,
+  type Span,
+} from "./mod.ts";
+import {
+  originalAttributeTokens,
+  originalPandocAttributes,
+} from "./attributes.ts";
+import { isSourceIdentity } from "./identity-id.ts";
+import { nativeDesignField, parseDesignAttributes } from "../render/design.ts";
+
+function fail(code: string, message: string): never {
+  throw new SourceError(code, message);
+}
+function escapeRegex(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function hasHtmlReference(text: string, id: string): boolean {
+  for (const tag of text.matchAll(/<[a-z](?:[^"'<>]|"[^"]*"|'[^']*')*>/gi)) {
+    for (
+      const attr of tag[0].matchAll(
+        /\s([^\s"'<>/=]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+))/g,
+      )
+    ) {
+      if (!["href", "xlink:href"].includes(attr[1].toLowerCase())) continue;
+      const value = (attr[2] ?? attr[3] ?? attr[4]).replace(
+        /&#(?:x([\da-f]+)|(\d+));?|&(num|colon|period|lowbar|hyphen);/gi,
+        (_, hex, decimal, named) => {
+          if (named) {
+            return ({
+              num: "#",
+              colon: ":",
+              period: ".",
+              lowbar: "_",
+              hyphen: "-",
+            } as Record<string, string>)[named.toLowerCase()];
+          }
+          const code = parseInt(hex ?? decimal, hex ? 16 : 10);
+          return code <= 0x10ffff ? String.fromCodePoint(code) : "\ufffd";
+        },
+      ).trim();
+      if (anchorMatches(value, id)) return true;
+    }
+  }
+  return false;
+}
+function anchorMatches(value: string, id: string): boolean {
+  if (!value.startsWith("#")) return false;
+  try {
+    return decodeURIComponent(value.slice(1)) === id;
+  } catch {
+    return false;
+  }
+}
+/** Shared dependency guard for verified slide or element deletion. */
+export function assertDeletionReferences(rest: string, ids: string[]): void {
+  for (const original of ids) {
+    const id = escapeRegex(original);
+    const markdownLinks = rest.matchAll(
+      /(?:\]\(\s*(?:<([^>]+)>|([^\s)]+))|^\s*\[[^\]]+\]:\s*(?:<([^>]+)>|(\S+)))/gm,
+    );
+    if (
+      new RegExp(`@${id}(?:\\.(?![\\w:.-])|(?![\\w:.-]))`).test(rest) ||
+      [...markdownLinks].some((match) =>
+        anchorMatches(match[1] ?? match[2] ?? match[3] ?? match[4], original)
+      ) || hasHtmlReference(rest, original)
+    ) {
+      fail(
+        "shared-reference",
+        `Other source references ${original}; deletion requires dependency resolution.`,
+      );
+    }
+  }
+}
+/** Include only this unit's immediately preceding technical identity marker. */
+function withMarker(doc: SourceDocument, block: SourceBlock): Span {
+  const before = sliceBytes(doc.text, { start: 0, end: block.span.start });
+  const marker = before.match(
+    /(?:^|\n)([ \t]*<!--[ \t]*qb:([^\s<>]+)[ \t]*-->[ \t]*(?:(?:\r\n|\n)[ \t]*)+)$/,
+  );
+  return {
+    start: marker?.[2] === block.id && isSourceIdentity(marker[2])
+      ? block.span.start - new TextEncoder().encode(marker[1]).length
+      : block.span.start,
+    end: block.span.end,
+  };
+}
+export interface SourceDeletion {
+  blockId: string;
+  removedIds: string[];
+  span: Span;
+  expected: string;
+  replacement: "";
+}
+/** A plain wrapper may provide identity/design, but cannot stand for a semantic component. */
+export function pureWrapper(
+  doc: SourceDocument,
+  parent: SourceBlock,
+  block: SourceBlock,
+): void {
+  const opener = parent.raw.split(/\r?\n/)[0].match(
+    /^ {0,3}(:{3,})[ \t]+\{([^{}]+)\}[ \t]*$/,
+  );
+  if (!opener) {
+    fail(
+      "unsafe-element-delete",
+      "The containing div has no verified standalone boundary.",
+    );
+  }
+  const attr = originalPandocAttributes(
+    opener[2],
+    originalAttributeTokens(opener[2]),
+  );
+  parseDesignAttributes(attr);
+  if (
+    attr[0] !== parent.id || attr[1].length ||
+    attr[2].some(([key]) =>
+      key !== "bento-element-id" && !nativeDesignField(key)
+    ) ||
+    new Set(attr[2].map(([key]) => key)).size !== attr[2].length
+  ) {
+    fail(
+      "unsafe-element-delete",
+      "A semantic component or unverified container must be edited explicitly in QMD.",
+    );
+  }
+  const descendants = doc.blocks.filter((candidate) =>
+    candidate !== parent && candidate.span.start >= parent.span.start &&
+    candidate.span.end <= parent.span.end
+  );
+  if (descendants.length !== 1 || descendants[0] !== block) {
+    fail(
+      "unsafe-element-delete",
+      "The containing div must contain exactly one independent authored element.",
+    );
+  }
+  const leading = sliceBytes(doc.text, {
+    start: parent.contentSpan.start,
+    end: block.span.start,
+  });
+  const trailing = sliceBytes(doc.text, {
+    start: block.span.end,
+    end: parent.contentSpan.end,
+  });
+  // Scanner ignores comments; refuse hidden syntax except the child's own identity marker.
+  const cleanLeading = block.explicitId
+    ? leading.replace(
+      new RegExp(
+        `^[ \t]*<!--[ \t]*qb:${
+          escapeRegex(block.id)
+        }[ \t]*-->[ \t]*(?:\r?\n|$)`,
+        "m",
+      ),
+      "",
+    )
+    : leading;
+  const closer = sliceBytes(doc.text, {
+    start: parent.contentSpan.end,
+    end: parent.span.end,
+  });
+  if (cleanLeading.trim() || trailing.trim() || closer.trim() !== opener[1]) {
+    fail(
+      "unsafe-element-delete",
+      "The containing div includes unverified syntax or a mismatched closing fence.",
+    );
+  }
+}
+/** Validate the source-only portion; core also verifies its exact executed provenance. */
+export function sourceDeletion(
+  doc: SourceDocument,
+  blockId: string,
+): SourceDeletion {
+  if (doc.diagnostics.length) {
+    fail(
+      "ambiguous-structure",
+      "Resolve source diagnostics before deleting an element.",
+    );
+  }
+  const matches = doc.blocks.filter((candidate) => candidate.id === blockId);
+  const block = matches[0];
+  if (
+    matches.length !== 1 || !block.editable || block.origin !== "authored" ||
+    !["paragraph", "list", "code", "math"].includes(block.kind) ||
+    !block.slideId
+  ) {
+    fail(
+      "unsafe-element-delete",
+      "Only one verified authored paragraph, list, displayed code or display equation can be deleted; headings and computed producers require explicit QMD authoring.",
+    );
+  }
+  let unit = block;
+  if (block.parentId) {
+    const parents = doc.blocks.filter((candidate) =>
+      candidate.id === block.parentId
+    );
+    const parent = parents[0];
+    if (
+      parents.length !== 1 || parent.kind !== "div" || !parent.stable ||
+      parent.parentId
+    ) {
+      fail(
+        "unsafe-element-delete",
+        "The element is nested inside an ambiguous or shared source container.",
+      );
+    }
+    pureWrapper(doc, parent, block);
+    unit = parent;
+  } else if (!block.stable) {
+    fail(
+      "unsafe-element-delete",
+      "Pin this standalone source element and recalculate before deleting it.",
+    );
+  }
+  const span = withMarker(doc, unit);
+  const removed = doc.blocks.filter((candidate) =>
+    candidate.span.start >= unit.span.start &&
+    candidate.span.end <= unit.span.end
+  );
+  if (removed.some((candidate) => candidate.origin !== "authored")) {
+    fail(
+      "unsafe-element-delete",
+      "Deletion would remove a computed or shared producer.",
+    );
+  }
+  const rest = sliceBytes(doc.text, { start: 0, end: span.start }) +
+    sliceBytes(doc.text, { start: span.end, end: doc.byteLength });
+  assertDeletionReferences(
+    rest,
+    removed.flatMap((candidate) =>
+      candidate.explicitId ? [candidate.explicitId] : []
+    ),
+  );
+  return {
+    blockId,
+    removedIds: removed.map((candidate) => candidate.id),
+    span,
+    expected: sliceBytes(doc.text, span),
+    replacement: "",
+  };
+}
+/** Removing a unit must leave all other semantic boundaries, identities and bytes intact. */
+export function verifySourceDeletion(
+  before: SourceDocument,
+  after: SourceDocument,
+  blockId: string,
+): void {
+  const removed = new Set(sourceDeletion(before, blockId).removedIds);
+  const shape = (blocks: SourceBlock[]) =>
+    blocks.map((block) => [
+      block.id,
+      block.explicitId,
+      block.kind,
+      block.raw,
+      block.content,
+      block.origin,
+      block.editable,
+      block.parentId,
+      block.slideId,
+      block.level,
+    ]);
+  if (
+    after.diagnostics.length ||
+    JSON.stringify(
+        shape(before.blocks.filter((block) => !removed.has(block.id))),
+      ) !== JSON.stringify(shape(after.blocks)) ||
+    JSON.stringify(before.slides.map((slide) => [slide.id, slide.stable])) !==
+      JSON.stringify(after.slides.map((slide) => [slide.id, slide.stable]))
+  ) {
+    fail(
+      "unsafe-element-delete",
+      "Deletion would change another source boundary or identity. Pin the remaining blocks or repair the surrounding QMD and recalculate before retrying.",
+    );
+  }
+}