@stackline/wcwidth 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to this package are documented here.
+
+## 1.0.0 - 2026-09-06
+
+- Continue the callable `wcwidth@1.0.1` CommonJS API and `.config()` behavior.
+- Remove the `defaults` and `clone` production dependency chain.
+- Use checksum-pinned Unicode 17.0.0 width and grapheme properties.
+- Count fully-qualified emoji, flags, keycaps, presentation sequences, and
+  emoji ZWJ sequences by grapheme cluster.
+- Add native ESM, first-party TypeScript declarations, browser bundler support,
+  reproducible Unicode generation, and a root-only production closure.
+- Add exact-artifact GitHub Actions publishing with a first-package token
+  bootstrap, npm provenance, registry verification, and Trusted Publisher OIDC
+  for later versions.

package/COMPATIBILITY.md

@@ -0,0 +1,5 @@
+# Compatibility
+
+The canonical compatibility definition is `COMPATIBILITY_CONTRACT.md`. It
+records the exact `wcwidth@1.0.1` API retained by this package and every
+intentional Unicode 17.0.0 behavior change.

package/COMPATIBILITY_CONTRACT.md

@@ -0,0 +1,75 @@
+# Compatibility contract
+
+Baseline: `wcwidth@1.0.1`.
+
+## Public surface
+
+`require('@stackline/wcwidth')` returns one callable function named `wcwidth`
+with arity one and no nested `default` property. Its enumerable own-property
+shape matches the baseline: `Object.keys(wcwidth)` is exactly `['config']`.
+The read-only, non-enumerable `unicodeVersion` property is an additive reference
+and is currently `17.0.0`.
+
+`import wcwidth from '@stackline/wcwidth'` returns an equivalent standalone ESM
+function and also exports `config` and `unicodeVersion`. `./package.json` is
+exported for tooling. The historical CommonJS subpaths `./index.js`,
+`./combining`, and `./combining.js` remain resolvable. The combining subpaths
+preserve the baseline array shape while exposing the maintained Unicode 17
+zero-width ranges.
+
+## Configuration
+
+The default options are `{ nul: 0, control: 0 }`.
+
+As in `wcwidth@1.0.1`, `config(options)` uses the supplied object directly. It
+adds missing `nul` and `control` properties, accepts inherited values, and the
+returned function observes later mutations. Falsy options select a new default
+object. Truthy primitives and non-extensible objects retain the historical
+coercive results. A negative configured control width causes a containing
+string to return `-1` at the first control character.
+
+The runtime preserves the historical handling of non-string inputs exercised
+by the upstream suite. First-party declarations describe this observable
+surface without adding implicit string conversion.
+
+## Unicode width model
+
+Strings are decoded as Unicode scalar values and split using the extended
+grapheme-cluster rules in Unicode Standard Annex #29. Generated data is pinned
+to Unicode 17.0.0 and does not depend on the ICU version of the executing Node
+runtime.
+
+- NUL uses the configured `nul` width.
+- C0, DEL, and C1 control characters use the configured `control` width.
+- zero-width, combining, and enclosing characters occupy zero columns.
+- East Asian Wide and Fullwidth characters occupy two columns.
+- East Asian Ambiguous characters occupy one column.
+- fully-qualified emoji, regional-indicator flags, keycaps, emoji-presentation
+  sequences, and qualifying emoji ZWJ sequences occupy two columns for the
+  complete grapheme cluster.
+- ordinary remaining scalar values occupy one column.
+- ANSI terminal escape sequences are ordinary input and are not stripped.
+
+## Intentional differences from 1.0.1
+
+The historical implementation iterated UTF-16 code units and used a table
+described as Unicode 5.0. This continuation intentionally corrects widths where
+that behavior disagrees with its pinned Unicode 17.0.0 model. Examples include:
+
+| Input | `wcwidth@1.0.1` | `@stackline/wcwidth@1.0.0` | Reason |
+| --- | ---: | ---: | --- |
+| `🤦🏼‍♂️` | 5 | 2 | one emoji grapheme cluster |
+| `U+D7B0..U+D7C6` | 1 | 0 | Hangul Jamo medial vowels |
+| `U+D7CB..U+D7FB` | 1 | 0 | Hangul Jamo final consonants |
+| `U+10330` | 2 | 1 | one supplementary narrow scalar value |
+
+The complete reviewed BMP difference set is a test fixture. Unicode and emoji
+conformance fixtures establish the maintained behavior rather than silently
+inheriting the host runtime's Unicode data.
+
+## Distribution contract
+
+The package supports Node.js 18 and newer plus current browser bundlers. It
+ships CommonJS, native ESM, TypeScript 3.9-compatible CommonJS declarations,
+modern conditional declarations, Unicode source metadata, and zero runtime,
+optional, peer, or bundled dependencies.

package/CONTRIBUTING.md

@@ -0,0 +1,18 @@
+# Contributing
+
+Use Node.js 18 or newer and install the exact development graph with:
+
+```sh
+npm ci --ignore-scripts
+```
+
+Run `npm run verify` before opening a pull request. Changes to width behavior
+must include focused regression tests, the relevant upstream or Unicode source,
+and an update to `COMPATIBILITY_CONTRACT.md` when observable output changes.
+
+Do not edit `lib/unicode-tables.js` by hand. Update checksum-pinned sources,
+regenerate the table, run `npm run unicode:check`, and include the applicable
+license or attribution change. Build output, coverage, tarballs, and release
+candidate evidence are not committed.
+
+Security reports should follow `SECURITY.md`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stackline maintainers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/MIGRATION.md

@@ -0,0 +1,39 @@
+# Migration
+
+## Preserve existing imports
+
+Replace the historical dependency value with an exact npm alias:
+
+```json
+{
+  "dependencies": {
+    "wcwidth": "npm:@stackline/wcwidth@1.0.0"
+  }
+}
+```
+
+Existing `require('wcwidth')` calls stay unchanged. Regenerate the lockfile with
+the downstream project's normal package manager. The installed manifest will
+identify `@stackline/wcwidth@1.0.0` while Node resolves the historical key.
+
+Alternatively, install the scoped package directly and update imports to
+`@stackline/wcwidth`.
+
+## Expected behavior
+
+The callable CommonJS API, `.config({ nul, control })`, default option values,
+configuration-object mutation, and historical non-string behavior remain.
+Native ESM and first-party TypeScript declarations are additive.
+
+Width results change where Unicode 17.0.0 grapheme and property data correct
+the Unicode 5-era, UTF-16-unit baseline. In particular, emoji ZWJ sequences,
+flags, keycaps, presentation sequences, modern combining characters, Hangul
+Jamo extensions, and supplementary scalar values may use different widths.
+
+## Downstream verification
+
+Run a clean install plus the downstream project's normal tests, lint, types,
+and build. Add representative assertions for ASCII, combining text, CJK,
+controls, a flag, a keycap, and an emoji ZWJ sequence. Applications with
+snapshot-aligned tables should review output containing emoji or post-Unicode-5
+characters before merging.

package/NOTICE

@@ -0,0 +1,15 @@
+@stackline/wcwidth is an independently maintained compatibility continuation
+of wcwidth@1.0.1. It is not affiliated with or endorsed by Tim Oxley, Jun Woong,
+Markus Kuhn, the original project, or the Unicode Consortium.
+
+The historical JavaScript API and behavior derive from wcwidth, a JavaScript
+port by Jun Woong of Markus Kuhn's wcwidth implementation. The complete notice
+distributed with wcwidth 1.0.1 is preserved in THIRD_PARTY_LICENSES.md.
+
+Generated width, emoji, and grapheme tables use Unicode Character Database and
+emoji data version 17.0.0. Exact source URLs and SHA-256 digests are recorded in
+unicode-sources.json. The Unicode License V3 is reproduced in
+THIRD_PARTY_LICENSES.md.
+
+The maintained Unicode model, grapheme handling, module distribution, types,
+and dependency-free configuration implementation are Stackline work.

package/PUBLISHING.md

@@ -0,0 +1,103 @@
+# Publishing
+
+## First-package bootstrap
+
+npm cannot configure a Trusted Publisher or staged publishing for a package
+that does not exist yet. Therefore `@stackline/wcwidth@1.0.0` cannot rely on
+OIDC for its first publication.
+
+To publish 1.0.0 from the reviewed GitHub artifact, create a temporary npm
+access token that is permitted to create and publish this public package. Store
+it only as the `NPM_BOOTSTRAP_TOKEN` secret in the GitHub `Prod` environment.
+Dispatch `publish.yml` from `main` with the successful CI run ID and
+`bootstrap: true`. The workflow still checks the exact commit, successful CI
+and CodeQL runs, downloads the CI tarball without rebuilding it, publishes that
+exact tarball with provenance, and performs registry verification.
+
+After 1.0.0 exists and verification succeeds, delete `NPM_BOOTSTRAP_TOKEN` from
+GitHub and revoke the temporary token at npm. Then configure the package's
+Trusted Publisher using the values below. All later versions must run with
+`bootstrap: false` and use OIDC.
+
+The workflow permits bootstrap only when the package itself is absent and the
+reviewed version is exactly 1.0.0. Once any package version exists, it rejects
+bootstrap mode. Do not claim or test OIDC publication before the npm package
+exists and the publisher is configured.
+
+## GitHub trusted publishing after bootstrap
+
+For a release, update the package, lockfile, changelog, compatibility contract,
+Unicode metadata, and versioned documentation. Run the complete local gate and
+push the reviewed commit to `main`. Wait for both CI and CodeQL to pass for that
+exact commit.
+
+Configure npm's Trusted Publisher as:
+
+- Owner: `alexandroit`
+- Repository: `stackline-wcwidth`
+- Workflow: `publish.yml`
+- Environment: `Prod`
+- Allowed action: `npm publish`
+
+Before dispatch, confirm repository release immutability is enabled using an
+administrator account:
+
+```sh
+gh api repos/alexandroit/stackline-wcwidth/immutable-releases
+```
+
+Dispatch `publish.yml` on `main` with the successful CI run ID as `ci_run_id`
+and `bootstrap: false`.
+The workflow checks the CI run identity, source commit, result, and CodeQL
+result. It downloads the reviewed `npm-package` artifact from that CI run and
+publishes that tarball using OIDC and provenance. It does not rebuild the
+package or use an npm token.
+
+After publication, `scripts/verify-registry.mjs` compares official npm bytes,
+validates the registry signature and provenance, and audits fresh normal scoped
+and legacy-key alias installations. The workflow retains the archive and
+verification record as `published-package-evidence`.
+
+If npm succeeds but verification fails, do not republish the version. The
+workflow can resume verification: it skips publication only when registry
+metadata and downloaded bytes exactly match the CI artifact. Different bytes
+or registry errors stop the workflow. Verification waits for new attestations
+to propagate and retries only attestation HTTP 404 responses, never invalid
+signatures.
+
+A recovery dispatch must also provide `expected_source_commit` and
+`expected_publication_run` from the original npm provenance. The verifier binds
+the subject name and digest, main-branch source commit, GitHub-hosted builder,
+workflow path, and invocation URL to those reviewed values. A fresh publication
+binds them directly to the current commit and workflow attempt.
+
+The publication workflow builds every checksum and metadata asset from the
+exact downloaded CI tarball after registry verification. It then requires one
+tarball plus exactly 11 linked evidence files. Download that single
+`published-package-evidence` artifact and preserve it without combining files
+from a local build. Create the annotated `stackline-v<version>` tag at the
+attested source commit and wait for its CI and CodeQL checks. Upload the exact
+12-file evidence set to a draft GitHub release, run
+`node scripts/check-release-assets.mjs <directory>`, and only then publish the
+release as immutable. Finally deploy the matching Alexandro.Net documentation
+and localized catalog entry.
+
+Never reuse a published npm version or replace a published tag or release
+asset.
+
+## Local artifact preparation
+
+A release may be prepared only from a clean, reviewed Git commit after
+`npm ci --ignore-scripts` and `npm run verify` pass on the pinned toolchain and
+required CI/CodeQL checks are green.
+
+Set `STACKLINE_GREEN_COMMIT` to the exact reviewed `HEAD`, then run:
+
+```sh
+npm run artifact:prepare
+```
+
+The command refuses a dirty worktree or existing `release-candidate`, reruns
+verification, and prepares a local review candidate. Those preliminary files
+must not be mixed into the GitHub release. Final release evidence is assembled
+only by `publish.yml` from the exact CI tarball that npm accepted.

package/README.md

@@ -0,0 +1,112 @@
+# @stackline/wcwidth
+
+A dependency-free compatibility continuation of `wcwidth@1.0.1` with
+deterministic Unicode 17.0.0 tables and grapheme-aware terminal widths.
+
+Stackline maintains this package independently. It is not affiliated with or
+endorsed by Tim Oxley, Jun Woong, Markus Kuhn, or the Unicode Consortium.
+
+## Install
+
+```sh
+npm install @stackline/wcwidth
+```
+
+An npm alias preserves an existing dependency key and every root import:
+
+```json
+{
+  "dependencies": {
+    "wcwidth": "npm:@stackline/wcwidth@^1.0.0"
+  }
+}
+```
+
+Historical CommonJS imports through `wcwidth/index.js`, `wcwidth/combining`,
+and `wcwidth/combining.js` also remain available under the alias. The combining
+table contains the maintained Unicode 17 zero-width ranges.
+
+CommonJS returns the callable function directly:
+
+```js
+const wcwidth = require('@stackline/wcwidth')
+
+wcwidth('한글')       // 4
+wcwidth('e\u0301')    // 1
+wcwidth('🤦🏼‍♂️')      // 2
+```
+
+Native ESM exposes an equivalent standalone default function plus named
+configuration and Unicode-version references:
+
+```js
+import wcwidth, { config, unicodeVersion } from '@stackline/wcwidth'
+
+const strictWidth = config({ nul: 0, control: -1 })
+strictWidth('hello\nworld') // -1
+console.log(unicodeVersion) // 17.0.0
+```
+
+## Compatibility contract
+
+The root CommonJS export remains a function named `wcwidth` with arity one.
+Its enumerable `.config(options)` method returns another function named
+`wcwidth` with arity one. Default NUL and control widths remain zero.
+
+For compatibility with `defaults@1.x`, `.config()` fills missing `nul` and
+`control` properties on the supplied object, observes inherited properties,
+and retains the object so later changes affect the configured function.
+
+Unicode results intentionally differ from the 2016 package where UTF-16 code
+units or Unicode 5-era tables produced incorrect terminal widths. The package
+uses pinned Unicode 17.0.0 data, extended grapheme segmentation, and these
+terminal rules:
+
+- combining marks and zero-width format characters occupy zero columns;
+- East Asian Wide and Fullwidth characters occupy two columns;
+- East Asian Ambiguous characters occupy one column;
+- fully-qualified emoji, flags, keycaps, emoji presentation sequences, and
+  emoji ZWJ sequences occupy two columns per grapheme cluster;
+- unpaired UTF-16 surrogates remain one column;
+- ANSI escape sequences are not stripped.
+
+See `COMPATIBILITY_CONTRACT.md` for the precise preserved API and intentional
+Unicode boundary.
+
+## Reproducible Unicode data
+
+`lib/unicode-tables.js` is generated from checksum-pinned Unicode 17.0.0
+sources recorded in `unicode-sources.json`.
+
+```sh
+npm run unicode:generate
+npm run unicode:check
+```
+
+The generator uses Node.js built-ins. Unicode source URLs, accepted hashes,
+license terms, generated-table invariants, and conformance fixtures are kept
+with the repository.
+
+## Runtimes and types
+
+- Node.js 18 or newer;
+- modern browsers through standard CommonJS or ESM bundlers;
+- callable CommonJS and native ESM default entries;
+- named ESM `config` and `unicodeVersion` exports;
+- TypeScript 3.9-compatible CommonJS declarations and modern conditional
+  ESM/CJS declarations;
+- zero runtime, optional, peer, and bundled dependencies.
+
+## Verification
+
+The release gate includes upstream characterization, full-BMP differential
+review, Unicode and emoji conformance corpora, table invariants, CJS/ESM/browser
+checks, TypeScript 3.9/current declarations, coverage, packed direct and legacy
+alias consumers, recursive closure, package/type linting, licenses, CycloneDX
+SBOM, audits, exact artifact identity, registry signatures, and provenance.
+
+## License
+
+The Stackline implementation is MIT licensed in `LICENSE`. The complete notice
+distributed with `wcwidth@1.0.1` and the Unicode License V3 are preserved in
+`THIRD_PARTY_LICENSES.md`.

package/SECURITY.md

@@ -0,0 +1,21 @@
+# Security policy
+
+## Supported versions
+
+The latest published `@stackline/wcwidth` version receives correctness,
+dependency, packaging, and release-integrity fixes.
+
+## Reporting
+
+Use GitHub private vulnerability reporting for
+`alexandroit/stackline-wcwidth`. Include the affected version, a minimal
+reproduction, expected and actual behavior, and any practical impact.
+
+Do not open a public issue containing exploit details or sensitive downstream
+information. Ordinary width discrepancies without a security impact may use a
+public issue with the exact input, expected width, terminal context, and Unicode
+reference.
+
+No vulnerability claim is made about `wcwidth@1.0.1`. This continuation focuses
+on maintained Unicode correctness, dependency removal, reproducible packaging,
+and release integrity.

package/THIRD_PARTY_LICENSES.md

@@ -0,0 +1,90 @@
+# Third-party licenses
+
+The production package has zero runtime, optional, peer, and bundled dependencies.
+Its installed production closure is one MIT-licensed Stackline root node.
+
+## wcwidth 1.0.1
+
+The compatibility API, selected historical behavior, and differential tests
+derive from `wcwidth@1.0.1`. Its package manifest declares `MIT`; the complete
+notice distributed in its `LICENSE` file is reproduced verbatim below.
+
+```text
+wcwidth.js: JavaScript Portng of Markus Kuhn's wcwidth() Implementation
+=======================================================================
+
+Copyright (C) 2012 by Jun Woong.
+
+This package is a JavaScript porting of `wcwidth()` implementation
+[by Markus Kuhn](http://www.cl.cam.ac.uk/~mgk25/ucs/wcwidth.c).
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+
+THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR
+OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+```
+
+The exact upstream package and its `defaults` and `clone` dependency chain are
+development-only differential fixtures. They are absent from the production
+graph.
+
+## Unicode Character Database 17.0.0
+
+Generated width, emoji, and grapheme tables and conformance fixtures derive
+from the Unicode data files listed with exact URLs and SHA-256 digests in
+`unicode-sources.json`.
+
+### Unicode License V3
+
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright © 1991-2026 Unicode, Inc.
+
+NOTICE TO USER: Carefully read the following legal agreement. BY DOWNLOADING,
+INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR SOFTWARE, YOU
+UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE TERMS AND CONDITIONS
+OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY,
+DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+data files and any associated documentation (the "Data Files") or software and
+any associated documentation (the "Software") to deal in the Data Files or
+Software without restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, and/or sell copies of the Data Files
+or Software, and to permit persons to whom the Data Files or Software are
+furnished to do so, provided that either (a) this copyright and permission
+notice appear with all copies of the Data Files or Software, or (b) this
+copyright and permission notice appear in associated Documentation.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD
+PARTY RIGHTS.
+
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE BE
+LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY
+DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder shall not be
+used in advertising or otherwise to promote the sale, use or other dealings in
+these Data Files or Software without prior written authorization of the
+copyright holder.

package/VERIFICATION.md

@@ -0,0 +1,29 @@
+# Verification
+
+Install pinned development tools without lifecycle scripts and run the complete
+gate:
+
+```sh
+npm ci --ignore-scripts
+npm run verify
+```
+
+The behavioral suite covers the historical upstream cases; CommonJS export
+shape; `.config()` defaults, mutation, inheritance, and coercive edges; the
+reviewed full-BMP differential; Unicode 17.0.0 width rules; UAX #29 grapheme
+conformance; fully-qualified emoji conformance; table invariants; native ESM;
+browser bundling; TypeScript 3.9/current declarations; and bounded stress cases.
+
+Packed scoped and historical-key npm-alias consumers verify package contents,
+callability, root and historical subpath exports, Unicode version, CommonJS,
+standalone ESM, esbuild and Rollup browser conditions, npm
+tree health, and the production audit. Separate checks prove the one-node
+production closure, upstream and Unicode attribution, CycloneDX SBOM, release
+metadata, strict publint, and strict Are the Types Wrong results. Production,
+full-development, and registry-signature audits complete the local gate.
+
+CI repeats the packed consumer across Node.js 18, 20, 22, 24, and 26 and on
+Linux, macOS, and Windows. CodeQL analyzes JavaScript and TypeScript. Official
+publication additionally requires byte identity with the CI artifact, npm
+signature and provenance validation, and fresh direct and alias registry
+consumers.

package/combining.d.ts

@@ -0,0 +1,3 @@
+declare const combining: Array<[number, number]>
+
+export = combining

package/combining.js

@@ -0,0 +1,5 @@
+'use strict'
+
+// Preserve the historical CommonJS subpath while exposing the maintained
+// Unicode 17 zero-width table used by the runtime.
+module.exports = require('./lib/unicode-tables').ZERO_WIDTH