@hadden-industries/markdown-quality 1.0.0 → 1.0.2

package/docs/consumer-guide.md

@@ -77,6 +77,9 @@ Lint messages describe the violated rule without quoting document content.
 These are conservative operational limits; benchmark and platform acceptance remains part of candidate qualification.
 
 Formatting compares maintained parsed structure and literals before replacement and verifies convergence.
+Fenced and indented code retain literal whitespace, including whitespace-only lines and trailing spaces; embedded code formatting remains disabled.
+Inline code compares [CommonMark code-span semantics](https://spec.commonmark.org/0.31.2/#code-spans): each line ending means one space, while interior spaces, tabs and other literal characters remain significant.
+Delimiter padding is already handled by the maintained parser; the comparison does not collapse or trim additional whitespace.
 The parsed comparison is an additional backstop, not a universal rendered-equivalence guarantee.
 It conservatively refuses unsupported semantic or literal changes.
 Ordinary file permission bits are preserved; ownership changes, alternate streams, ACL inheritance, arbitrary metadata, and adversarial filesystem races are not promised as preserved.

package/docs/support-and-release.md

@@ -15,9 +15,18 @@ An opt-in compatible feature may use a minor version.
 Changed defaults require a new preset major, and a package major when existing invocations change.
 Dependency upgrades are classified from observed corpus and consumer deltas.
 Never overwrite a published version.
+After npm accepts publication, allow up to five minutes for anonymous version metadata and both installer metadata representations to expose the exact approved integrity.
+Only a processing 404 is retried; mismatched integrity and other failures stop delivery.
+Publication is never repeated by this availability check.
+The three bounded waits fit within the publisher's thirty-minute job limit.
 
-The current source prepares version 1.0.0 under the pilot tag; stable promotion remains gated.
+The current source prepares version 1.0.2 under the pilot tag; stable promotion remains gated.
 Stable promotion requires the same qualified tuple on both platforms, public registry readback and unauthenticated installation, both pilot acceptances, and a timed restoration exercise.
+The 1.0.1 corrective candidate restores checking and formatting of literal code lines containing trailing or whitespace-only spaces.
+The original 1.0.1 tuple is published under `pilot` and passed both-platform complete registry qualification in recovery run `37413673170`, without republishing any package.
+The 1.0.2 correction compares inline-code line endings as spaces under CommonMark, retaining meaningful interior whitespace and the strict fenced/indented-code guard.
+This repair changes shipped JavaScript and therefore requires a new coordinated patch version; the unchanged 1.0.0 tuple completed registry qualification separately in recovery run `37409484508`.
+Keep latest promotion blocked until the literal-preservation repair and exact candidate satisfy the same platform, registry and pilot gates.
 Changed/referrer mode and later fleet adoptions remain deferred.
 
 Prepare assets explicitly from their frozen manifest.
@@ -40,8 +49,8 @@ An upstream Cargo lock is a superset of features and development inputs and does
 The original upstream license and per-asset repack identity are retained.
 
 The owner selected public distribution after npm rejected the private publication with E402.
-All three packages declare public access and share the source candidate version 1.0.0.
-It retains alpha.4's qualified native executable/source/notice bytes and avoids duplicate formatting of byte-identical documents while retaining independent prose checks and preservation/convergence checks.
+All three packages declare public access and share the source candidate version 1.0.2.
+The tuple retains alpha.4's qualified native executable/source/notice bytes and avoids duplicate formatting of byte-identical documents while retaining independent prose checks and preservation/convergence checks.
 The first alpha.3 hosted OWLAPI shadow checks passed correctness but exceeded the accepted 30-second budget on both platforms.
 Alpha.3 and alpha.4 remain immutable historical evidence; every new tuple requires fresh transported-archive, registry, and exact-version pilot qualification before promotion.
 The public alpha.2 archives remain immutable historical delivery evidence and are unqualified for Linux execution.
@@ -51,9 +60,17 @@ The unpublished private alpha.1 candidate and all rejected attempts remain histo
 Direct first publication uses explicit public access; a staged placeholder is unnecessary.
 The manual publisher uses npm 12.2.0 in hosted CI and requires all three npm trusted-publisher mappings for this repository, publish.yml and the npm-publication environment.
 That environment must permit exactly the main branch.
-It verifies a successful same-source candidate run, all three same-attempt jobs, the approved manifest digest and exact frozen archive bytes before publishing native packages and then core under pilot.
+Ordinary publication verifies a successful same-source candidate run, all three same-attempt jobs, the approved manifest digest and exact frozen archive bytes.
+Recovery preserves the original candidate's source and archives separately from the current reviewed publishing-control source.
+An admission job without OIDC binds a complete three-package origin map before effects; both platform jobs qualify previously attempted packages before the publisher may run.
+Only a prior planned effect with an explicitly skipped publication step is eligible for first publication; an attempted or unknown outcome must be verified in the registry and cannot become eligible through a 404.
+Each downstream job rehashes its downloaded archives against the admitted manifest.
+The publisher rechecks current main, all three local archive hashes and version absence immediately before each single eligible publication, verifies both native archives before core, and uses only pilot.
 Only the publication job has OIDC issuance permission; no long-lived npm token is supplied.
-Both registry jobs use native npm signature/attestation verification and bind the verified provenance to the approved source, workflow and publication run.
+Both registry jobs use native npm signature/attestation verification and bind each installed package to its admitted source, workflow, exact publication run and attempt.
+Their explicit non-cancellation and successful-publication condition prevents a skipped recovery ancestor from suppressing final qualification after ordinary publication.
+Successful publication alone does not establish complete registry qualification; retain both actual terminal platform reports.
+Each platform installs and cryptographically verifies its supported native package and core; opposite-platform native archives receive anonymous raw-byte verification, with the combined platform records covering the complete tuple.
 Structural provenance fixtures do not establish cryptographic acceptance.
 The workflow does not promote latest; both pilots and recovery must accept the exact tuple first.
 GitHub artifacts expire after 30 days, so export the complete frozen source, manifest, archives and verification bundles to the retained evidence store before expiry, for the security policy's maintained-lifetime-plus-three-years floor.
@@ -67,6 +84,17 @@ Qualify root and isolated consumers on both supported platforms from the registr
 Do not perform registry publication while rights, publisher authentication, independent assurance, or platform evidence remains missing.
 A partial publication stays unpromoted and receives a new corrective version if bytes change.
 
+For unchanged-version recovery, manually dispatch `publish.yml` with the original `candidate-run` and `manifest-sha256`, plus the terminal prior `recovery-run` and exact `recovery-attempt`.
+The original legacy publication can omit `recovery-origins-sha256` only when its source is the original artifact source and its retained manifest matches exactly.
+For a later recovery, independently approve the prior admission map's SHA-256 and pass it as `recovery-origins-sha256`; never infer expected origins from the attestation being verified.
+Retain the actual dispatch inputs, original candidate/manifest, admission artifact, per-package map, provider attempts/jobs, effect outcomes and both registry reports.
+Use a new manual dispatch rather than blindly rerunning a partial publication.
+After known acceptance, availability polling retries metadata 404 or an installer metadata document whose version map has not yet acquired the target version for at most five minutes with bounded requests; it never invokes publication again.
+The version endpoint, abbreviated installer metadata and full installer metadata share that deadline; every visible target must match the approved name, version and integrity.
+Anonymous qualification repeats this admission before installing; malformed metadata, mismatched bytes and access failures are terminal.
+The publication job is bounded to 30 minutes to accommodate three independent visibility waits and native verification; failed or cancelled jobs require evidence reconciliation, not automatic publication retries.
+An unavailable attempted package, mismatched bytes/origin, non-404 registry failure or unresolved live producer stops delivery until its outcome is established.
+
 For recovery, retain the exact consumer base revision, old manifest and lock, workflows, selected document preimages, and unrelated-file sentinels.
 Restore only migration-owned changes.
 Verify byte identities and required checks, then record elapsed restoration time.
@@ -91,7 +119,8 @@ The memory budgets are 512 MiB Windows Job Object committed memory and 512 MiB L
 These budgets do not impose OS runtime limits or raise existing package limits.
 Require zero unexpected errors or adjudicated false positives in the window and accepted fixture/probe corpus, retaining expected negative probes separately.
 Rehearse one task-owned pilot restoration within 60 minutes through byte/sentinel readback and incumbent local checks; hosted required-status recovery remains separate acceptance evidence.
-Accepted budgets do not establish that the pending Linux corpus, hosted pilots, or restoration have passed.
+The alpha.4 pilot cutovers passed both hosted platform windows and scoped restoration; those records do not establish acceptance of a later exact tuple.
+Version 1.0.1 requires fresh per-consumer scope, hosted platform windows, restoration and exact trusted-run acceptance before promotion.
 
 Provide AGPL corresponding source and build materials alongside object-code delivery to actual recipients.
 Preserve third-party license texts and attribution.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadden-industries/markdown-quality",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Shared, bounded Markdown formatting, GFM linting, and local-link checking",
   "type": "module",
   "license": "AGPL-3.0-only",
@@ -46,7 +46,7 @@
     "prettier": "3.9.9"
   },
   "optionalDependencies": {
-    "@hadden-industries/markdown-quality-win32-x64": "1.0.0",
-    "@hadden-industries/markdown-quality-linux-x64": "1.0.0"
+    "@hadden-industries/markdown-quality-win32-x64": "1.0.2",
+    "@hadden-industries/markdown-quality-linux-x64": "1.0.2"
   }
 }

package/src/formatting.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-only
-import * as prettier from "prettier";
+import { formatLayout } from "./literal-layout.js";
 import { parse } from "./analysis.js";
 import { runNative } from "./native-tool.js";
 import { checkProse } from "./prose-diagnostics.js";
@@ -11,6 +11,10 @@ function semantic(node) {
     if (key === "children") value.children = item.map(semantic);
     else if (key === "value" && node.type === "text")
       value.value = item.replace(/\s+/gu, " ");
+    // CommonMark code spans turn each line ending into one space. The parser
+    // already strips delimiter padding; preserve all other literal characters.
+    else if (key === "value" && node.type === "inlineCode")
+      value.value = item.replace(/\r\n|\r|\n/gu, " ");
     else value[key] = item;
   }
   return value;
@@ -30,8 +34,8 @@ export async function formatDocument(text, context, tool) {
     tabWidth: context.config.layout.tabWidth,
     plugins: [],
   };
-  const layout = await prettier.format(text, options);
-  const result = await prettier.format(runNative(tool, layout), options);
+  const layout = await formatLayout(text, options);
+  const result = await formatLayout(runNative(tool, layout), options);
   // Byte identity proves preservation and an observed fixed point of the entire
   // deterministic formatter pipeline. The independent prose check still runs.
   if (result === text)
@@ -41,7 +45,7 @@ export async function formatDocument(text, context, tool) {
     JSON.stringify(semantic(parse(result)))
   )
     fail("PRESERVATION", "Formatting changed parsed meaning or a literal.");
-  const second = await prettier.format(runNative(tool, result), options);
+  const second = await formatLayout(runNative(tool, result), options);
   if (result !== second)
     fail("CONVERGENCE", "Formatter pipeline did not converge.");
   return { output: result, diagnostics: checkProse(tool, result) };

package/src/literal-layout.js

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import { createHash } from "node:crypto";
+import * as prettier from "prettier";
+import { parse } from "./analysis.js";
+import { fail } from "./contracts.js";
+
+// embeddedLanguageFormatting: off still allows Prettier to trim code-line
+// whitespace. Keep those lines nonempty until layout finishes, then remove the
+// absent marker before native analysis or the unchanged semantic guard runs.
+export async function formatLayout(text, options) {
+  const rows = text.split(/(\r\n|\r|\n)/u);
+  const selected = new Set();
+  function visit(node, quoteDepth = 0) {
+    if (node.type === "blockquote") quoteDepth++;
+    if (node.type === "code") {
+      // mdast locates actual opening fences at their marker; indented code
+      // starts at its indentation, even if its literal text resembles a fence.
+      const opening = /^(`{3,}|~{3,})/u.exec(
+        text.slice(node.position.start.offset),
+      );
+      let closing = rows[(node.position.end.line - 1) * 2];
+      for (let quote = 0; quote < quoteDepth; quote++) {
+        const prefix = /^[ \t]*>[ \t]?/u.exec(closing);
+        if (!prefix) {
+          closing = "";
+          break;
+        }
+        closing = closing.slice(prefix[0].length);
+      }
+      closing = closing.replace(/^[ \t]+|[ \t]+$/gu, "");
+      const closed =
+        opening &&
+        closing.length >= opening[1].length &&
+        [...closing].every((character) => character === opening[1][0]) &&
+        // A fence-shaped line can itself be literal content. The maintained
+        // parser omits a real closer from its value; compare source/value line
+        // counts rather than inferring valid closing indentation ourselves.
+        (node.value === "" ||
+          node.position.end.line -
+            node.position.start.line -
+            (node.position.end.column === 1 ? 1 : 0) >
+            node.value.split(/\r\n|\r|\n/u).length);
+      // An EOF position at column one names the following empty source row,
+      // not another literal line. Marking it would add a newline to the value.
+      const endLine =
+        node.position.end.line -
+        (closed || node.position.end.column === 1 ? 1 : 0);
+      for (
+        let line = node.position.start.line - (opening ? 0 : 1);
+        line < endLine;
+        line++
+      )
+        if (
+          rows[line * 2] !== undefined &&
+          (rows[line * 2] === "" || /\s$/u.test(rows[line * 2]))
+        )
+          selected.add(line * 2);
+    }
+    for (const child of node.children ?? []) visit(child, quoteDepth);
+  }
+  visit(parse(text));
+  if (!selected.size) return prettier.format(text, options);
+  let marker;
+  for (let code = 0xe000; code < 0xe100; code++) {
+    const candidate = String.fromCharCode(code);
+    if (!text.includes(candidate)) {
+      marker = candidate;
+      break;
+    }
+  }
+  marker ??= `MQ_LITERAL_${createHash("sha256").update(text).digest("hex")}`;
+  if (text.includes(marker))
+    fail("PRESERVATION", "Cannot protect literal layout without a collision.");
+  for (const line of selected) rows[line] += marker;
+  const formatted = await prettier.format(rows.join(""), options);
+  if (formatted.split(marker).length - 1 !== selected.size)
+    fail("PRESERVATION", "Formatting changed literal layout protection.");
+  return formatted.replaceAll(marker, "");
+}