@heroiclands/package-build 23.10.0 → 23.12.0

package/docs/design.md

@@ -21,6 +21,25 @@ An Address identifies a subject by package, system, type, and shortcode. It is i
 
 The content index uses JSON Lines. A record can retain the note's full frontmatter, anchors, and outgoing links, and streams without loading one giant JSON array. It is derived, disposable, and stable for a fixed source tree and toolchain version. SQL queries and editor navigation read that index rather than guessing from filenames.
 
+## Reference presentation and access
+
+An indexed subject has one ordinary wikilink syntax regardless of its audience.
+The renderer derives spoiler presentation from the actual destination, so an
+author does not duplicate a privacy declaration on every mention. The `.show`
+override reveals a particular reference without changing the destination's
+audience. A separate inline `.secret` span marks authored text as a spoiler.
+
+Concealment and access remain separate decisions. Public site and book builds
+omit GM-only notes; a reference to an omitted destination carries no unusable
+link. Foundry's private packs and page permissions govern destination access.
+Web inline spoilers use a separate show/hide control beside their content, so
+a revealed link is independently usable. Foundry inline spoilers use a CSS
+redaction revealed on hover or keyboard focus; they have no native secret-section
+permission behavior. Books ignore inline `.secret` and preserve normal text
+formatting. A spoiler in published HTML remains readable in the source. See the
+[authoring contract](authoring/links-and-markup.md#references-to-secret-subjects)
+for syntax and surface presentation.
+
 ## Build boundaries
 
 The content pass reads `assets/content/` and addressable assets. It emits the content index, page source, and Foundry documents. Site rendering and book typesetting consume those outputs; their layout decisions do not become fields of a Foundry DataModel. Packaging stages only the files a Foundry manifest declares. The build checks emitted fields against the target system schema because Foundry can otherwise discard an unknown field without an error.

package/docs/guides/book.md

@@ -522,6 +522,17 @@ Anchors on headings are scoped to their entries, so two entries can use the
 same heading anchor. The build reports an unresolved destination while
 keeping the source available for inspection.
 
+A reference to a GM-only note or secret heading prints normally. GM-only notes
+remain omitted, and references to them print as text without a link. `.show`
+does not add an omitted destination to the book. Inline `[text]{.secret}` spans
+print as ordinary text, preserving emphasis, links, anchors and `.name` bold
+styling; the book ignores their `.secret` class.
+
+Secret sections and `:::secret` fences keep their visible contents in pale
+lavender boxes (`#f2eefb`) with a purple left border and title (`#5c4b8a`). The
+default title is **! Secret**; a fence can supply its own title. See
+[secret references](../authoring/links-and-markup.md#references-to-secret-subjects).
+
 The [generated sections](../reference/format-details.md#generated-sections)
 an entry carries — **Within**, **Governed by**, **In song and story**, the
 event views and the rest — name notes the build chose rather than the author,

package/docs/guides/site.md

@@ -118,6 +118,13 @@ Wikilinks resolve through the address index. Each emitted page receives
 derived `related` entries for the links its author wrote and the backlinks
 other authors wrote to it.
 
+A wikilink to a GM-only note or secret heading conceals its whole reference in
+an inline show/hide spoiler. `.show` reveals the reference without changing the
+destination's audience. GM-only pages remain omitted, so references to them
+have no link; published secret sections retain theirs. Spoiler text remains in
+the generated HTML and is readable in page source. See
+[secret references](../authoring/links-and-markup.md#references-to-secret-subjects).
+
 What lies within a place, who governs it, what an affiliation governs, the
 works naming a note and the map from a place reach the page as
 [generated sections](../reference/format-details.md#generated-sections): H1

package/docs/reference/format-details.md

@@ -515,7 +515,10 @@ is declared, so a near miss is a finding that names what you probably meant.
 
 `gm` marks a note for GM access. It is excluded from public site pages, SQL
 tables on the public site, and the book. Foundry compiles it only to private
-compendiums. A regular note cannot link to it; a GM note can.
+compendiums. Any note may reference it with an ordinary wikilink; the
+reference is automatically a spoiler. The `.show` override reveals that
+reference without changing the destination's audience or access permissions;
+see [references to secret subjects](#references-to-secret-subjects).
 
 **`draft` marks unfinished content.** It does two things and nothing
 else: a link _into_ a draft note renders marked, and the note itself states that
@@ -1808,6 +1811,38 @@ name at every citation with no link edited. `[[x|]]` is labelled; `[[x]]` is not
 It is the label that is required, not a target: the anchor-only form above
 carries its pipe like every other link.
 
+#### References to secret subjects
+
+Use `[[doc-divineactn|The Truth of Divine Action]]` for an indexed subject,
+including one with a GM-only audience. The renderer derives spoiler presentation
+from the resolved destination and conceals the whole reference, including its
+label. A public destination has no automatic concealment. An anchor inside secret
+content is a secret destination, including a same-note anchor reference. A
+link to the whole public note does not inherit a section's secrecy.
+
+The website renders an inline show/hide spoiler; an omitted GM-only target
+retains its reference as text without a dead link. A published secret section
+retains its link. Foundry renders a CSS-redacted inline spoiler, revealed on
+hover or keyboard focus, with destination access controlled by private packs
+and page permissions. Books ignore inline `.secret` presentation and print
+references normally, retaining text without a link when the GM-only destination
+is omitted. `.show` bypasses automatic spoiler presentation on the website and
+in Foundry; book references already print normally. An unavailable destination
+still has no link.
+
+An immediately following `.show` attribute explicitly reveals the reference:
+
+```markdown
+[[doc-divineactn|The Truth of Divine Action]]{.show}
+[[doc-magictruth|The Truth of Magic]]{.show}
+```
+
+This override changes the reference's presentation only. It does not publish a
+GM-only note, alter Foundry permissions or reveal the destination's content.
+It is redundant for public destinations. `[text]{.secret}` separately marks
+text itself as a spoiler; it declares no destination audience. See
+[inline spans](#inline-spans) for inline spoiler syntax and surface behavior.
+
 #### Marking names in prose
 
 `package-build lint` reports name-marking warnings in authored body prose.
@@ -1815,7 +1850,10 @@ The warnings leave a valid package passing. Headings, frontmatter, tables,
 infoboxes, code, comments and embeds are outside this check.
 
 A name is explicit: a `[Name]{.name}` bracket span or an authored link label.
-Use `.name` for names without indexed notes and links for names with notes.
+Use typed `.name` spans for unwritten subjects and ordinary wikilinks for
+indexed subjects, including private ones. Introduce another subject with its
+full canonical name at its first prose use; use plain text for the note's own
+subject and for later mentions and aliases.
 Plain prose is not searched for names. Wikilinks, ordinary Markdown links and
 reference links all supply names; a resolved empty wikilink label uses the
 note's full name. Images, code, footnote markers and bare autolinks without
@@ -1856,7 +1894,7 @@ An optional `data-type` on a `.name` span states what the named thing is:
 
 ```markdown
 [Ravenmoor]{.name data-type="place/settlement"}
-[Aldric Venn]{.name data-type="being"}
+[Aldric Venn]{.name data-type="being/npc"}
 ```
 
 Use a declared [note type](note-types.md), optionally followed by `/` and one
@@ -2630,7 +2668,13 @@ local to a note; rendered markers are sequential numbers. A Foundry page
 collects its referenced footnotes in a Footnotes section at the bottom of that
 JournalEntryPage, while a book places them at the bottom of the page of
 reference. A term followed by `: definition` lines creates a definition list.
-See the [authoring examples](../authoring/links-and-markup.md#footnotes-and-definition-lists).
+After a blank line, indent continuation paragraphs and blocks by four spaces
+to keep them in the same definition; indent a code block's opening fence,
+contents and closing fence. Another `:` starts a separate definition for the
+same term. See the [authoring examples](../authoring/links-and-markup.md#footnotes-and-definition-lists). Definition lists use dictionary hanging indents: bold, nonwrapping terms,
+normal definitions, a 150px shared column (100px at browser widths up to 600px),
+a `.75em` term gap and `.5em` entry spacing. A long term pushes only the first
+definition line beyond the shared column; continuation lines return to it.
 
 ```
 # Heading {#id .class1 .class2 attr="value"}
@@ -3483,6 +3527,27 @@ The watch wears [a _blue_ sash]{#watch-sash .uniform lang=en}.
 
 The exact `.name` class marks a name, with optional `data-type="type/subType"`;
 see [marking names in prose](#marking-names-in-prose) for the vocabulary and index.
+The exact `.secret` class marks the enclosed text as an inline spoiler:
+
+```markdown
+[The hidden **passage**]{.secret}
+[Aldric Venn]{.name .secret data-type="being/npc"}
+```
+
+The website provides an inline show/hide button and preserves interactive links
+inside the revealed content. Foundry renders a focusable, CSS-redacted inline
+span that reveals its text and nested content on hover or keyboard focus.
+Native Foundry secret sections retain their own controls. Books ignore `.secret`
+on inline spans, preserving their text, emphasis, links, anchors and `.name`
+bold styling. Secret sections and `:::secret` fences keep their visible labelled
+boxes. Published HTML retains the text, so opening the spoiler or inspecting the
+source reveals it.
+
+This span has no effect on a destination's audience. Ordinary wikilinks derive
+spoilers from their resolved destinations; `.show` bypasses that automatic
+concealment without cancelling an enclosing authored `.secret`. An inline span
+does not change the scope of `.secret` headings or `:::secret` blocks, and it
+does not start or withhold a JournalEntryPage.
 
 Inline Markdown remains active inside the span. Bracket spans have lower priority than URL links, image links, reference links, footnotes and wikilinks. A bracketed form immediately preceded by `!`, followed by `(` or another `[`, or beginning with `[[` is not a span, even when the link is unresolved. Ordinary links retain their existing syntax. Escape a bracket when it should be literal, or put examples inside a code span or fence. A span identifier addresses that point in the note; it does not start a journal page.
 
@@ -4499,7 +4564,7 @@ three fields are built around.
   unrecorded. Both spellings of `died` mean dead.
 - **`age` is optional and is an override.** Written, it wins over anything the
   dates say. Unwritten beside a dated `born`, it is the age that follows from
-  the date and the package's declared present — see below. Unwritten beside
+  the date and the configured current date — see below. Unwritten beside
   `born: unknown` or an absent `born`, the age is unknown.
 
 Most people in a setting do not know their own birth date, so an age beside
@@ -4512,22 +4577,15 @@ read it.
 
 #### The age a dated `born` computes to
 
-A package states the day its setting stops on `data.present`, on its own
-`world` or `celestial` `place` note — see _What a body states about itself_
-under `type: place`. Against that date, a being with a dated `born` and no
-authored `age` compiles the age it implies: the two dates compared, not the
-two years subtracted, so a birthday that falls later in the year than the
-present counts one less than the years alone would say. A package that
-declares no present computes no age and says nothing about it — the same
-silence a package with no calendar mechanism meets.
-
-**An authored `age` beside a dated `born` is expected to agree with what the
-date computes.** Where it does not, `package-build lint` raises a warning
-naming both values, so a stale age left behind after a `born` was corrected
-does not go unnoticed. The warning is silent beside `born: unknown` or an
-absent `born` — there is nothing there to disagree with — and silent wherever
-the package declares no present, for the same reason no age is computed at
-all.
+The root configuration's `currentDate` states the setting's neutral current
+date, defaulting to `"720.1"`. A being with a dated `born` and no authored `age`
+compiles the age implied by those dates. A birthday later in the year counts one
+less than the difference between the years. A year-only birth date uses day one.
+Unknown and absent birth dates supply no computed age.
+
+An authored `age` beside a dated `born` is expected to agree with the configured
+current date. `package-build lint` warns when the values disagree. Authored ages,
+including zero and estimates such as `~34`, remain unchanged in built output.
 
 Use `born:` for a being's birth date.
 
@@ -6933,7 +6991,6 @@ level with no background prints nothing.
 | `year.hoursPerDay`                | `number`                                                                         | How many hours the day divides into                                                                       |
 | `year.minutesPerHour`             | `number`                                                                         | How many minutes the hour divides into                                                                    |
 | `year.secondsPerMinute`           | `number`                                                                         | How many seconds the minute divides into                                                                  |
-| `present`                         | `date`                                                                           | The day the setting stops and play begins                                                                 |
 | `body.diameterKm`                 | `number`                                                                         | The body's diameter, in kilometres                                                                        |
 | `body.orbitalRadiusKm`            | `number`                                                                         | How far it orbits from the body it circles, in kilometres                                                 |
 | `body.orbit`                      | `string`                                                                         | The orbit's shape — `circular` means the cycle never varies                                               |
@@ -6965,7 +7022,6 @@ about the world's year.
 data:
   world: { equatorialCircumferenceKm: 40000, surfaceGravityG: 1.0, axialTiltDegrees: 23.5 }
   year: { days: 365, hoursPerDay: 24, minutesPerHour: 60, secondsPerMinute: 60 }
-  present: 720
 
 # its moon — a note of its own, because a moon is a body and not a property
 data:
@@ -6983,14 +7039,13 @@ else wrote down.
 can say which one a calendar divides; a `moon` with no `year` anywhere is
 refused, because a cycle counted in days has no year to be measured against.
 
-**`present` is the day an age is computed against**, written in the grammar a
-note's dates are written in, so a setting whose present is best said in an era
-says it that way.
+The root configuration's `currentDate` supplies the neutral date used for age
+calculations throughout the setting. Its default is `"720.1"`.
 
 **`world.axialTiltDegrees`, the circumference, the gravity, the moon's diameter
 and its orbital radius are read by nobody.** They are there so a reader knows
 what kind of world this is. What the build consumes is the year, the day's
-divisions, the present, the moon's cycle and epoch, and whether its orbit is
+divisions, the moon's cycle and epoch, and whether its orbit is
 circular and inclined.
 
 #### What a settlement's market supports

package/docs/reference/note-types.md

@@ -885,7 +885,6 @@ Lore records in-world knowledge. A `culture` describes a people; a `custom` desc
 | `data.year.hoursPerDay`                | number                                                            | How many hours the day divides into.                                                                                                                                                |
 | `data.year.minutesPerHour`             | number                                                            | How many minutes the hour divides into.                                                                                                                                             |
 | `data.year.secondsPerMinute`           | number                                                            | How many seconds the minute divides into.                                                                                                                                           |
-| `data.present`                         | a date                                                            | The day the setting stops and play begins — what an age is computed against.                                                                                                        |
 | `data.body.diameterKm`                 | number                                                            | The body's diameter, in kilometres.                                                                                                                                                 |
 | `data.body.orbitalRadiusKm`            | number                                                            | How far the body orbits from the one it circles, in kilometres.                                                                                                                     |
 | `data.body.orbit`                      | string                                                            | The orbit's shape — `circular` means the cycle never varies.                                                                                                                        |

package/docs/reference/theme-pages.md

@@ -515,4 +515,4 @@ A row is a linked title and, when the page carries one, its description.
 
 ## Alerts
 
-The content renderer emits an `aside` with `alert` and `alert-note`, `alert-tip`, `alert-important`, `alert-warning` classes. The `alert-title` header contains a Font Awesome icon and the type's label. Shared styles supply a colored left rule, colored header and ordinary readable body; alerts do not use `details` and never start collapsed. Authored identifiers, additional classes and named attributes belong to the entire aside. Secret blocks retain their separate expandable presentation on the website.
+The content renderer emits an `aside` with `alert` and `alert-note`, `alert-tip`, `alert-important`, `alert-warning` classes. The `alert-title` header contains a Font Awesome icon and the type's label. Shared styles supply a colored left rule, colored header, tinted background and readable body text. The website uses the dark palette; Foundry selects a light or dark palette from its color scheme. Alerts do not use `details` and never start collapsed. Authored identifiers, additional classes and named attributes belong to the entire aside. Secret blocks retain their separate expandable presentation on the website.

package/docs/source-preview.md

@@ -0,0 +1,172 @@
+---
+shortcode: source-preview
+name: { full: "Source preview and Gitea renderer" }
+type: doc
+subType: reference
+---
+
+# Source preview and Gitea renderer
+
+Preview renders only the supplied Markdown buffer. It works with ordinary
+Markdown, optional YAML frontmatter, and local Heroic Lands extensions, without
+configuration, a content tree, dependency caches, a content index or Pandoc.
+
+```sh
+package-build-preview < note.md > preview.html
+package-build-preview --dark < note.md > preview.html
+package-build-preview --current-date 740.1 < note.md > preview.html
+package-build-preview --css > preview.css
+```
+
+The command writes an HTML fragment by default. Include `preview.css` in the
+hosting page to apply the syntax colors, panels and tinted alerts. Light mode
+is the default; `--dark` is explicit and independent of browser preferences.
+`--css` emits both scoped palettes and does not read stdin. `--help` lists the
+options. Unsupported arguments exit 1. Findings go to stderr; success exits 0,
+and render errors exit 1. A partial preview may accompany error findings.
+
+Wikilinks, image and portrait links retain their complete source: blue brackets,
+purple addresses, bold foreground labels and grey attributes. Entire spans are bold, including their visible brackets and attributes.
+Definition-list terms are bold and definitions use normal text. SQL and pagelist fences remain grey source;
+they never execute. Calendar expressions, dependent expressions, references and
+maps remain green source. Local expressions can evaluate against authored
+frontmatter. Missing ages are calculated from neutral birth dates and the root
+`currentDate` setting, defaulting to `"720.1"`, as for other package outputs.
+Authored ages, including `0`, take precedence. Unknown or calendar-dependent
+birth dates omit the age row; `{{data.age}}` is empty when unavailable. Generated sections,
+related pages and See also are absent. Preview performs no publication or link
+checks. Alerts render with their icons, titles, Markdown bodies and tinted
+backgrounds, including nested alerts. Secret blocks are closed disclosure
+spoilers. An authored `.secret` heading hides its section through the next
+heading at the same or a higher level, while retaining its anchor. Secret spans
+redact their label until hover or keyboard focus; explicit `.secret` wikilink
+and image attributes similarly redact their inner source. The authored outer
+brackets and attributes remain visible. This uses scoped CSS and a focusable
+wrapper, with no preview JavaScript required.
+
+Applications import `renderPreview` and `previewStyles` from
+`@heroiclands/package-build/preview`. The HTML wrapper has `hl-preview` and
+exactly one mode class: `hl-preview-light` or `hl-preview-dark`. See the
+[API reference](api.md) for the function contract.
+
+## Current date
+
+Declare the setting-wide date as a quoted root configuration value:
+
+```yaml
+currentDate: "720.1"
+```
+
+The standalone command discovers the nearest `package-build.config.yaml`,
+`.yml` or `.mjs` from its working directory. YAML reads only `currentDate`; it
+requires no other package fields, content or index. MJS executes its trusted
+configuration module. Missing configuration or an absent setting uses `"720.1"`.
+Invalid explicit values fail with a configuration diagnostic. Use
+`--current-date DATE` to override discovery for one invocation. Dates must use
+neutral `<year>[.<day>[:HHMMSS]]` syntax; named-calendar dates are refused.
+
+The pure `renderPreview` API accepts `currentDate` and never reads configuration.
+Hosts can opt into `await readPreviewCurrentDate(projectRoot)` to read the root
+setting before rendering. Repeated calls observe configuration edits. This is
+the same root setting used by compilation, website output and other toolchain
+consumers; there is no separate preview date setting.
+
+## Gitea installation
+
+Install Node 24 or newer and this package in the Gitea runtime, including the
+container image when applicable. The examples assume installation at
+`/opt/heroiclands/node_modules/@heroiclands/package-build` and a usable Node
+executable on Gitea's PATH. Pin the package version in the installation's
+`package.json` and lockfile.
+
+Copy [the complete renderer configuration](../assets/preview/gitea.ini) into
+`app.ini`. It replaces whole-file rendering for the listed Markdown extensions;
+it does not replace Gitea's issue-comment or pull-request discussion renderer.
+The renderer section must appear before its sanitizer sections. Its command
+reads stdin and emits HTML; it needs no repository checkout. Change the absolute
+command path to match the installation. Gitea normally uses the shared default
+`"720.1"` because it receives no repository checkout. To select the deployment's
+setting-wide date explicitly, use:
+
+```ini
+RENDER_COMMAND = /opt/heroiclands/node_modules/.bin/package-build-preview --current-date 740.1
+```
+
+Keep this override aligned with the setting's root configuration. Without an
+override, run Gitea from a directory with no package-build configuration so
+unrelated local configuration cannot select the date.
+
+The supplied configuration keeps sanitization enabled and disables Gitea's
+post-processing so preserved source and literal links remain intact. It permits
+only the preview's class families on the elements that need them, plus the SVG
+attributes needed for alert icons. Gitea's default SVG rules retain `viewBox`,
+`width`, `height`, `aria-hidden`, path `d` and `fill-rule`; the extra rules retain
+`fill="currentColor"` and circle coordinates. The wrapper mode class, syntax
+span classes, fence classes and infobox wrapper must survive sanitization for
+styling to work. Source is escaped text, so no additional source-data attributes
+are required. The `secretFocus` rule retains only `tabindex="0"` on span
+wrappers so keyboard users can reveal redacted source labels. Do not enable
+arbitrary styles, scripts or data-URI images.
+
+Install the stylesheet and optional theme adapter beneath the Gitea custom
+path. Here `custom` means the actual instance's `CustomPath`:
+
+```sh
+mkdir -p custom/public/assets/css custom/public/assets/js
+/opt/heroiclands/node_modules/.bin/package-build-preview --css > custom/public/assets/css/heroiclands-preview.css
+cp /opt/heroiclands/node_modules/@heroiclands/package-build/assets/preview/gitea-theme.js custom/public/assets/js/heroiclands-preview.js
+```
+
+Add to `custom/templates/custom/header.tmpl`, preserving existing content:
+
+```html
+<link rel="stylesheet" href="{{AppSubUrl}}/assets/css/heroiclands-preview.css" />
+<script defer src="{{AppSubUrl}}/assets/js/heroiclands-preview.js"></script>
+```
+
+Restart Gitea after configuration/template changes. Regenerate the CSS asset
+when updating the package. These are administrator installation instructions;
+package-build does not deploy or change the server configuration.
+
+## Gitea theme selection
+
+The external renderer runs on the server and cannot see a reader's active
+theme. The installed browser adapter reads Gitea's root CSS variable
+`--is-dark-theme`, selecting dark for `true` and light for `false`. It follows
+`data-theme` changes, stylesheet loads and newly inserted preview nodes. It
+changes only `.markup.markdown .hl-preview` mode classes; the surrounding Gitea
+interface keeps its own colors. A custom theme that omits the variable retains
+the initial renderer mode.
+
+Without the browser adapter, use the default command for fixed light rendering,
+or append `--dark` to `RENDER_COMMAND` for fixed dark rendering. Explicit CLI
+mode never changes itself. Theme adaptation happens only when the administrator
+installs the separate browser script.
+
+## Sanitizer validation
+
+[The validation harness](../assets/preview/check-sanitizer.go) applies the
+shipped INI rules using the actual `bluemonday` sanitizer and the relevant
+Gitea SVG defaults. It requires a Go toolchain and a temporary module with
+`github.com/microcosm-cc/bluemonday` at the version used by the target Gitea
+release. Run it against generated preview HTML:
+
+```sh
+go run check-sanitizer.go /path/to/gitea.ini < preview.html > sanitized.html
+```
+
+Check both light and dark fixtures containing all four alert types, a custom
+title, nesting, wikilinks and attributes, SQL/pagelist fences, infoboxes, poetry
+and footnotes. All wrapper/token classes and icon shapes should remain, while
+injected scripts and event-handler attributes should disappear. This replay
+checks the sanitizer primitives; also inspect the result in the actual Gitea
+version before deployment, since defaults can vary between releases.
+
+Configuration and installation follow Gitea's
+[external renderer documentation](https://docs.gitea.com/administration/external-renderers/).
+The relevant implementation contracts are its
+[command adapter](https://github.com/go-gitea/gitea/blob/main/modules/markup/external/external.go),
+[sanitizer defaults](https://github.com/go-gitea/gitea/blob/main/modules/markup/sanitizer_default.go),
+[renderer settings](https://github.com/go-gitea/gitea/blob/main/modules/setting/markup.go),
+[root theme attribute](https://github.com/go-gitea/gitea/blob/main/templates/base/head.tmpl),
+and [theme scheme variable](https://github.com/go-gitea/gitea/blob/main/web_src/css/themes/theme-gitea-dark.css).

package/engine/anchors.mjs

@@ -41,7 +41,7 @@ import { scanPoetry } from "./content-poetry.mjs";
 import { scanSpans } from "./content-spans.mjs";
 import { slugify } from "./content-slug.mjs";
 import { scanFigures } from "./content-figures.mjs";
-import { scanHeadingAttributes } from "./heading-attributes.mjs";
+import { withheldSections, scanHeadingAttributes } from "./heading-attributes.mjs";
 import { positionOfFrontmatterPath } from "./diagnostics.mjs";
 
 /**
@@ -67,11 +67,12 @@ export const ANCHOR_KINDS = Object.freeze(["prose", "event"]);
  *   {@link module:engine/content-figures.scanFigures}.
  * @param {import("./content-session.mjs").ContentSyntax} [syntax] - Exact-text scanner projections.
  * @returns {Array<{slug: string, name: string, level: number, line: number,
- *   kind: string}>} In document order.
+ *   kind: string, secret?: boolean}>} In document order.
  */
 export function collectAnchors(body, bodyLine = 1, resolveRole, syntax) {
     const anchors = [];
-    for (const heading of scanHeadingAttributes(body, bodyLine).headings) {
+    const headings = scanHeadingAttributes(body, bodyLine).headings;
+    for (const heading of headings) {
         if (!heading.id) continue;
         anchors.push({
             slug: heading.id,
@@ -91,9 +92,12 @@ export function collectAnchors(body, bodyLine = 1, resolveRole, syntax) {
             kind: "prose",
         });
     }
+    const secretBlocks = [];
     const blockAnchors = (source, firstLine) => {
         const sourceLines = source.split("\n");
         for (const block of (syntax ? syntax(source).blocks : scanBlocks(source)).blocks) {
+            if (block.name === "secret")
+                secretBlocks.push({ start: firstLine + block.start, end: firstLine + block.end });
             if (block.id)
                 anchors.push({
                     slug: slugify(block.id),
@@ -129,7 +133,8 @@ export function collectAnchors(body, bodyLine = 1, resolveRole, syntax) {
                 kind: "prose",
             });
     }
-    for (const span of (syntax ? syntax(body).spans : scanSpans(body)).spans) {
+    const spans = (syntax ? syntax(body).spans : scanSpans(body)).spans;
+    for (const span of spans) {
         if (span.id)
             anchors.push({
                 slug: slugify(span.id),
@@ -139,6 +144,33 @@ export function collectAnchors(body, bodyLine = 1, resolveRole, syntax) {
                 kind: "prose",
             });
     }
+    const sections =
+        headings.some((heading) => heading.classes.includes("secret")) ?
+            withheldSections(body).sections
+        :   [];
+    const secretSpans = spans.filter((span) =>
+        span.attrs.some(([key, value]) => key === "class" && value.split(/\s+/).includes("secret")),
+    );
+    const secretSpanAnchors = new Set(
+        spans
+            .filter(
+                (target) =>
+                    target.id &&
+                    secretSpans.some(
+                        (parent) => parent.start <= target.start && parent.end >= target.end,
+                    ),
+            )
+            .map((span) => span.id),
+    );
+    for (const anchor of anchors) {
+        const line = anchor.line - bodyLine;
+        if (
+            sections.some((section) => line >= section.start && line < section.end) ||
+            secretBlocks.some((block) => anchor.line >= block.start && anchor.line <= block.end) ||
+            secretSpanAnchors.has(anchor.slug)
+        )
+            anchor.secret = true;
+    }
     return anchors.sort((a, b) => a.line - b.line);
 }
 

package/engine/base-compiler.mjs

@@ -103,10 +103,11 @@ import { packForType } from "./ids.mjs";
 import { resolveNoteId } from "./note-ids.mjs";
 import { carriesSystemBlock } from "./system-block.mjs";
 import { checkAuthoredSystemData, checkEmittedSystemData } from "./schema-check.mjs";
-// A being's computed `age`, filled in against the package's own declared
-// present before this pass reads `data:` for anything else — see
+// A being's computed `age`, filled in against the configured setting
+// current date before this pass reads `data:` for anything else — see
 // `engine/being-age.mjs`.
-import { applyComputedBeingAge, presentAmongRecords } from "./being-age.mjs";
+import { applyComputedBeingAge } from "./being-age.mjs";
+import { normalizeCurrentDate } from "./current-date.mjs";
 import { reckoningContext } from "./reckoning-markers.mjs";
 import { loadPackConfig } from "./pack-config.mjs";
 import { annotateAssetReferences, assetReferenceLookup } from "./asset-references.mjs";
@@ -632,10 +633,8 @@ export class BasePackCompiler {
         if (this.constructor.convertsWikilinks) {
             this.sqlTables = this.corpus.sqlTables;
         }
-        // The package's declared present, read once from the same corpus — so
-        // a being's computed `age` reaches every compiled document, not only
-        // the content index.
-        this.worldPresent = presentAmongRecords(this.corpus.records);
+        // Use the compile corpus's setting date.
+        this.currentDate = normalizeCurrentDate(this.corpus.currentDate);
         this.unresolvedLinks = 0;
     }
 
@@ -1277,7 +1276,7 @@ export class BasePackCompiler {
                 stats.skippedOther++;
                 continue;
             }
-            applyComputedBeingAge(fm, this.worldPresent, dates);
+            applyComputedBeingAge(fm, this.currentDate, dates);
             // `package:` is refused before `selects`, so a note is answered
             // whichever pass would have claimed it: a note's package is the
             // repository's configured one, so declaring it restates a