@hadden-industries/markdown-quality 0.1.0-alpha.2

package/README.md

@@ -0,0 +1,45 @@
+# Markdown quality
+
+This package supplies one CLI and library for Markdown layout, sentence lines, GFM linting, and contained local links.
+Consumers declare their authored-document scope in `.markdown-quality.json`.
+The package preserves the existing AGPL-3.0-only license.
+
+The current version is a candidate for public alpha distribution.
+Controlled native component clearance and Windows/Linux packed qualification passed for the retained binaries.
+The public package tuple requires fresh registry qualification before use; both accepted pilots and recovery evidence still block stable v1.0.
+
+```sh
+markdown-quality check --root /path/to/repository
+markdown-quality format --root /path/to/repository
+markdown-quality inspect --root /path/to/repository --json
+markdown-quality check --root /path/to/repository -- "docs/literal [1].md"
+markdown-quality check --root /path/to/repository --files-json '[]'
+```
+
+Checks never install tools or write documents.
+Formatting validates the complete selected batch before any replacement.
+It checks each file's original identity and bytes immediately before replacing it.
+A failure after earlier replacements reports the completed and unprocessed paths.
+Formatting is not a whole-batch transaction.
+
+Read the [consumer guide](docs/consumer-guide.md) for configuration and installation.
+The [support and release guide](docs/support-and-release.md) describes compatibility and release gates.
+The [third-party notices](THIRD-PARTY-NOTICES.md) distinguish package code from upstream assets.
+
+Development uses Node 24.21.0 and an existing Python 3.14 interpreter for asset preparation.
+Consumers need no Python interpreter.
+
+```sh
+npm ci --ignore-scripts
+python scripts/prepare-native.py --archives /path/to/verified/archives
+npm test
+npm run check:full
+node scripts/pack.js /path/to/output
+```
+
+The builder accepts the frozen `snapper-windows.zip` and `snapper-linux.tar.xz` archives.
+It verifies archive and executable hashes before copying fixed regular members.
+Build acquisition is explicit; product operations never acquire executables.
+
+Changed-document checking and a shared GitHub Action are deferred.
+Required v1.0 checks always inspect the full authored scope.

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,34 @@
+# Third-party notices
+
+Package-owned implementation is AGPL-3.0-only.
+The original repository license is retained byte-for-byte.
+The narrow list-boundary recheck in `src/prose-diagnostics.js` adapts OwlAPI's approach at `1cdc5a33b9538cce8ced88f21af18138da7a8923`, originally from universal-ontology at `58a306013d3701f59dfe34341e96fac5a011e3ed`.
+Copyright 2026 Hadden Industries Ltd; original MIT terms are retained in `LICENSES/MIT-universal-ontology.txt`.
+The qualification tests are authored here.
+
+| Direct runtime dependency   | Version | Declared license                  |
+| --------------------------- | ------- | --------------------------------- |
+| Prettier                    | 3.9.9   | MIT                               |
+| ESLint                      | 10.12.0 | MIT                               |
+| ESLint Markdown             | 8.0.3   | MIT                               |
+| Ajv                         | 8.20.0  | MIT                               |
+| mdast-util-from-markdown    | 2.1.0   | MIT                               |
+| mdast-util-gfm              | 3.1.0   | MIT                               |
+| micromark-extension-gfm     | 3.0.0   | MIT                               |
+| picomatch                   | 4.0.7   | MIT                               |
+| Snapper upstream executable | 0.11.9  | MIT, Copyright 2026 Rohit Goswami |
+
+Installed npm packages retain their upstream license files.
+The lockfile freezes their exact integrity identities.
+Native packages retain `LICENSE.snapper` and a fixed executable/repack component record.
+The AGPL declaration applies to the packaging implementation and does not relabel upstream executable bytes.
+
+Controlled native build run `37274204161` binds Snapper source, Cargo inputs, Rust toolchain and the exact Windows/Linux executable hashes.
+Both native packages retain the original component inventories, complete harvested notices, official Rust runtime copyright report and unchanged MPL-2.0 `webpki-roots` 0.25.4 source.
+The separately recorded [rights supplement](assets/native-rights.json) restores original notices omitted from published crate archives, including native per-file copyright comments.
+Every native archive and package includes its exact `rights-evidence.json` and readable `SUPPLEMENTAL-NOTICES.txt`.
+Independent reconciliation cleared the identified attribution gaps; the original hosted evidence remains unchanged.
+Registry distribution still requires actual platform and packed-consumer qualification, restricted publication and readback.
+No complete rights clearance or SLSA level is claimed from a hash or upstream MIT declaration alone.
+
+Primary authorities: [Snapper license](https://github.com/TurtleTech-ehf/snapper/blob/v0.11.9/LICENSE), [Snapper source manifest](https://github.com/TurtleTech-ehf/snapper/blob/v0.11.9/Cargo.toml), [npm lock semantics](https://docs.npmjs.com/cli/v12/configuring-npm/package-lock-json/), and [AGPL text](https://www.gnu.org/licenses/agpl.en.html).

package/assets/native-build.json

@@ -0,0 +1,56 @@
+{
+  "schemaVersion": 1,
+  "sourceCommit": "407c2beb04607f6ccb421e6f6418dcc00e4c1e94",
+  "lockSha256": "ae679d5bed2cf65a72e422448bb7de70f9893ae4755f1d87ee38b3c27cfeb85d",
+  "manifestSha256": "58f9c619a86a9b8f1bb776c4c3022e393a5c596260cf44c5b40272833ec400ff",
+  "rust": "1.98.1",
+  "rustSourceCommit": "48a229ceaefd4985c50990b14116b6d856af0985",
+  "rustRuntimeLicenseInputs": [
+    {
+      "path": "LICENSE-MIT",
+      "url": "https://raw.githubusercontent.com/rust-lang/rust/48a229ceaefd4985c50990b14116b6d856af0985/LICENSE-MIT",
+      "sha256": "b71bd43a069ca0641a9ecfe585ca7b3c53b5cc1608f8b68321168698e28b5ea1"
+    },
+    {
+      "path": "LICENSE-APACHE",
+      "url": "https://raw.githubusercontent.com/rust-lang/rust/48a229ceaefd4985c50990b14116b6d856af0985/LICENSE-APACHE",
+      "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a"
+    },
+    {
+      "path": "LICENSES/Unicode-3.0.txt",
+      "url": "https://raw.githubusercontent.com/rust-lang/rust/48a229ceaefd4985c50990b14116b6d856af0985/LICENSES/Unicode-3.0.txt",
+      "sha256": "f5062c9a188d81dfe66b56db4182dcf9e4b17c0d9b0d311a8e20b3a1b075c443"
+    }
+  ],
+  "profile": "dist",
+  "features": ["cli", "neural", "lsp", "watch", "pandoc", "treesitter", "mcp"],
+  "auditExtractor": {
+    "url": "https://static.crates.io/crates/rust-audit-info/rust-audit-info-0.5.4.crate",
+    "sha256": "4691a1a98b31dc5c7b55a2968628c79ed035b1fad6b3b3849d872244e04bcf83",
+    "sourceCommit": "17fc93a92a952cc5e715bc51afc25e11049d7036"
+  },
+  "tools": {
+    "win32-x64": {
+      "target": "x86_64-pc-windows-msvc",
+      "cargo-auditable": {
+        "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v0.7.7/cargo-auditable-x86_64-pc-windows-msvc.zip",
+        "sha256": "717ba2d3ed7997c501e9987ee7c94bebf9d7219b18b185a03009420ec7029c7d"
+      },
+      "cargo-about": {
+        "url": "https://github.com/EmbarkStudios/cargo-about/releases/download/0.9.2/cargo-about-0.9.2-x86_64-pc-windows-msvc.tar.gz",
+        "sha256": "1c03e5890238562497c2d89a3b75b02560af349c1fc3e713d3284f532a5cd748"
+      }
+    },
+    "linux-x64": {
+      "target": "x86_64-unknown-linux-gnu",
+      "cargo-auditable": {
+        "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v0.7.7/cargo-auditable-x86_64-unknown-linux-gnu.tar.xz",
+        "sha256": "4c8d3b08c3c34e9f2333367224dbbfb4aab68067698b43de59fe19aded3416dd"
+      },
+      "cargo-about": {
+        "url": "https://github.com/EmbarkStudios/cargo-about/releases/download/0.9.2/cargo-about-0.9.2-x86_64-unknown-linux-musl.tar.gz",
+        "sha256": "9099a59e820c38a68b9d65f300662a567d56562f9a10f6aa4c7e86c17c2566af"
+      }
+    }
+  }
+}