feat(markdown): support Markdown-It 13 hosts

.changeset/healthy-geese-compare.md

@@ -0,0 +1,9 @@
+---
+'@bidilens/markdown': patch
+---
+
+Expand the optional Markdown-It peer range to cover widely deployed 13.x and 14.x
+hosts without exposing either line's third-party types through the public API.
+A packed strict TypeScript/peer consumer gate now runs all 932 canonical cases
+plus host-structure fixtures through both parser lines and requires identical
+batch, plugin, AST, security, isolation, and finalized streaming output.

.github/workflows/ci.yml

@@ -97,6 +97,33 @@ jobs:
       - run: pnpm run packages:types
       - run: pnpm run release:check
 
+  markdown-it-compat:
+    name: Markdown-It 13 and 14 compatibility
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        with:
+          version: 10.27.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.12.0
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run markdown-it:compat
+        env:
+          BIDILENS_MARKDOWN_IT_REPORT_DIR: markdown-it-compat-reports
+      - if: ${{ failure() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: markdown-it-compat-reports
+          path: markdown-it-compat-reports
+          if-no-files-found: error
+          retention-days: 7
+
   android:
     name: Android libraries and sample
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -30,6 +30,7 @@ jobs:
       - run: pnpm exec playwright install --with-deps chromium firefox webkit
       - run: pnpm run test:visual
       - run: pnpm run packages:types
+      - run: pnpm run markdown-it:compat
       - run: pnpm run deps:audit
       - run: pnpm run release:check
       - run: pnpm run sbom

CONTRIBUTING.md

@@ -84,6 +84,7 @@ Changesets entry for a public API or behavior change. Before a release run:
 pnpm run check
 pnpm run test:visual
 pnpm run packages:types
+pnpm run markdown-it:compat
 pnpm run deps:audit
 pnpm run release:check
 pnpm run sbom

README.md

@@ -146,7 +146,7 @@ reordering and shaping; BidiLens supplies the application structure they need.
 | `@bidilens/core` | Analysis, evidence, isolation, streaming, and security |
 | `@bidilens/dom` | DOM annotation, restoration, CSS policy, and observation |
 | `@bidilens/html` | XSS-safe semantic HTML serialization |
-| `@bidilens/markdown` | unified/remark/rehype and Markdown-It plugins plus rich Markdown-It streaming |
+| `@bidilens/markdown` | unified/remark/rehype and Markdown-It 13/14 plugins plus rich Markdown-It streaming |
 | `@bidilens/playwright` | Rendering, isolation, selection, clipboard, and geometry assertions |
 | `@bidilens/react` | SSR-safe components and streaming hooks |
 | `@bidilens/spec` | Versioned cross-language JSON Schemas and schema registry |
@@ -289,7 +289,8 @@ cargo clippy --manifest-path rust/Cargo.toml --all-targets --all-features -- -D
 ```
 
 `verify:production` runs the complete quality, three-browser visual, package
-type, dependency-audit, SBOM, and clean-release sequence. `release:check`
+type, packed Markdown-It 13/14 compatibility, dependency-audit, SBOM, and
+clean-release sequence. `release:check`
 builds and packs every public package, inspects tarball contents, installs all
 tarballs into a temporary consumer, compiles with `skipLibCheck: false`, and
 executes adapter/runtime assertions—including the pure-LTR non-interference

docs/LIMITATIONS.md

@@ -42,7 +42,9 @@ deliberately checkpointed by source growth and structural boundaries; inspect
 `pendingSourceRange` before treating a
 live `document` as current. `finish()` is the exact batch-equivalence boundary.
 Unified/remark/rehype transforms remain supported as batch plugins, not as a
-stateful unified streaming backend.
+stateful unified streaming backend. Markdown-It 13.0.2+ and 14.x are verified
+with packed strict TypeScript consumers; other parser major versions are not a
+supported or tested claim.
 
 ## Validation boundaries
 

docs/OUTREACH_LOG.md

@@ -42,7 +42,7 @@ endorsement.
 | Cline VS Code webview | [PR #12724](https://github.com/cline/cline/pull/12724) | Open, mergeable, and ready for review; all fresh hosted checks passed on the rebased head; maintainer review required | Applies `@bidilens/markdown` at the existing React Markdown render boundary and adds Persian-majority, English-majority, and pure-English identity tests. Quality, unit, platform-integration, VS Code on Ubuntu/Windows, E2E on Ubuntu/macOS/Windows, and both Socket security checks passed on 2026-08-13. |
 | Continue | [comment on issue #2767](https://github.com/continuedev/continue/issues/2767#issuecomment-5088124777) | Parent issue closed; reconsideration requested | Replaces the proposed global RTL rule with Auto/LTR/RTL policy and offers a focused GUI or fixtures-only patch. No new duplicate issue was created. |
 | assistant-ui | [Show and tell #5211](https://github.com/assistant-ui/assistant-ui/discussions/5211) | Open | Distinguishes the project's completed logical-layout work from per-message mixed-content direction and offers a documented `@bidilens/react` streaming recipe, adapter, hook, or fixtures-only path. |
-| AnythingLLM | [comment on canonical RTL issue #3430](https://github.com/Mintplex-Labs/anything-llm/issues/3430#issuecomment-5126056699) | Parent issue open | Supplies a per-block acceptance fixture and integration guidance. A direct dependency patch was deferred because the host supports Node 18 and Markdown-It 13 while BidiLens 0.3 requires Node 22.12 and peers with Markdown-It 14; raising either compatibility floor would be a regression. |
+| AnythingLLM | [comment on canonical RTL issue #3430](https://github.com/Mintplex-Labs/anything-llm/issues/3430#issuecomment-5126056699) | Parent issue open | Supplies a per-block acceptance fixture and integration guidance. [BidiLens PR #57](https://github.com/CodeinScrubs/BidiLens/pull/57) addresses the Markdown-It 13 peer/type gap with packed cross-version evidence, but AnythingLLM's Node 18 floor still conflicts with BidiLens 0.3's Node 22.12 minimum; a native fixtures-only patch remains the non-regressive route unless that runtime boundary changes. |
 | Vercel Streamdown | [PR #569](https://github.com/vercel/streamdown/pull/569) | Open, mergeable, and ready for review; review and security automation passed; maintainer review required | Adds a dependency-free native rehype pass because Streamdown supports Node 18. It assigns direction per semantic block, keeps code LTR, uses content majority with a first-strong tie-breaker, preserves pure-LTR behavior, and includes 985 passing package tests plus a production ESM/declaration build. The Vercel preview remains blocked on external-fork deployment authorization. |
 | Sentry | [feature request #120893](https://github.com/getsentry/sentry/issues/120893) | Open on the design-engineering backlog at low priority; a Sentry maintainer does not expect the BidiLens dependency to be adopted | Proposes content-aware behavior at Sentry's shared React Markdown renderer and Seer wrapper. After the maintainer noted Sentry's existing i18n tooling, the follow-up explicitly preferred a native/local implementation, offered fixtures only if requested, and committed not to bump the issue. This is backlog evidence, not dependency adoption. |
 | PostHog | [feature request #75474](https://github.com/PostHog/posthog/issues/75474) | Open | Proposes per-block handling in `LemonMarkdown` and PostHog AI's already memoized `MarkdownMessage` blocks. The public feature tracker was used instead of the automated email's sales-demo form, which requires company, role, and monthly-active-user data and is not an appropriate open-source engineering route. |
@@ -59,7 +59,7 @@ production-adoption confirmation when this evidence was recorded.
 |---|---|---|
 | JetBrains AI Assistant YouTrack | JetBrains support directed the proposal to the public AI Assistant tracker. A duplicate search found the directly matching, open, assigned [LLM-25407](https://youtrack.jetbrains.com/issue/LLM-25407/Arabic-RTL-Bidirectional-text-rendering-issue-in-Codex-input-field), so no duplicate was created. | Pending account authentication: add one implementation-focused comment with the English-first/Persian-majority fixture, BidiLens corpus and limitation links, and an offer of a scoped renderer patch. |
 | Nous Research support | The automated receipt for the original proposal assigned reference `T-1645`, while Hermes PR #72508 remained open without human review. | Sent one short follow-up on 2026-08-13 pointing directly to the PR and asking for routing to the Hermes TUI maintainer. |
-| n8n support | The support AI said the original proposal had been escalated to a human product/engineering queue, but no human response arrived. | Sent one short follow-up on 2026-08-13 asking whether the team received it or prefers a public feature-request route. |
+| n8n support | Senior support engineer Mo Hamdy confirmed the supported contribution route is an n8n Community feature request before any enhancement PR. He also confirmed that `@n8n/chat` uses Markdown-It without raw HTML and that a third-party dependency needs prior maintainer agreement. | A concise reply and [community proposal](outreach/N8N_COMMUNITY_PROPOSAL.md) are drafted, committing to a dependency-free-first approach: fixtures and a native renderer pattern, with BidiLens optional. Sending and posting remain pending explicit user confirmation. |
 
 ## Direct organizational outreach
 
@@ -93,7 +93,7 @@ unmonitored addresses, and delivery failures did not receive follow-up mail.
 | Zulip | The customer-experience lead identified [issue #39511](https://github.com/zulip/zulip/issues/39511) and the existing `#issues` topic for mixed LTR/RTL messages. | Replied that the issue directly overlaps the proposal, clarified the per-paragraph and inline-isolation scope, and committed to continue with small before/after fixtures in the public topic. |
 | Zed | A Zed representative confirmed that more RTL support is useful but stated that a non-Rust dependency is a non-starter. | The original reply accurately disclosed that no Rust port existed at that time. After [native Rust core PR #31](https://github.com/CodeinScrubs/BidiLens/pull/31) merged, a focused follow-up supplied the source-only status, 928-case/207-isolation evidence, Rust 1.85 target, and final Linux/macOS/Windows CI result. No response to that follow-up, Zed integration, or adoption is claimed. |
 | Ollama | The support AI requested product feedback in problem/current-behavior/expected-behavior form. After receiving that clarification, it confirmed the submission contains the information its team uses for feature review and made no timeline or adoption commitment. | Sent one structured clarification with the repository and regression-corpus context; stopped after the automated confirmation to avoid an AI-response loop. |
-| n8n | The support AI said it escalated the proposal to a human product/engineering review queue. | After no human response arrived, sent one short follow-up on 2026-08-13 asking whether the team received the proposal or prefers a public feature-request route. No further email will be sent without a reply. |
+| n8n | Senior support engineer Mo Hamdy replied with the public feature-request route and renderer constraints: Markdown-It, no raw HTML, and prior maintainer agreement before adding a dependency. | Prepared a human reply and a narrower community proposal strategy that leads with fixtures and a native renderer change. BidiLens PR #57 independently adds verified Markdown-It 13/14 compatibility, but it is not presented as a dependency mandate. |
 | Nous Research | An automated receipt assigned support reference `T-1645` and promised a later follow-up. | After no human response arrived, sent one short follow-up on 2026-08-13 that points directly to Hermes PR #72508 and asks for routing to the TUI maintainer. The public PR remains the primary technical channel. |
 | JetBrains and Sentry | These responses routed the proposal to public trackers. | The resulting tracker evidence is recorded above; no redundant support-email reply was sent. |
 | PostHog | An automated response identified an unmonitored inbox and linked support and sales-oriented routes that were unsuitable for an open-source engineering proposal. | No email reply was sent. The public feature request recorded above was opened independently. |
@@ -115,7 +115,7 @@ human review.
 | Sentry | A design-engineering maintainer placed the behavior on the team's low-priority backlog, said Sentry already has i18n tooling, and did not expect to adopt the BidiLens dependency. | Replied once that the behavior is the request, not a dependency mandate; preferred a native/local implementation; offered a small fixture if requested; and committed not to bump the issue. |
 | Cline | PR #12724 had become conflicting with current upstream. After a narrow rebase, only the lockfile required regeneration; the component, package manifest, and regression tests applied cleanly. | Rebased with force-with-lease, preserved the host lockfile's formatting, and reran hosted CI. All quality, unit, platform, VS Code, three-OS E2E, and security checks passed. No maintainer approval is claimed. |
 | Nous Research | Support reference `T-1645` remains an automated receipt with no human follow-up. Separately, `hermes-sweeper` revalidated PR #72508 against current `main`, found no verified problem, and recommended keeping it open with high salvageability. | Kept the public PR as the primary technical channel and sent one short routing follow-up on 2026-08-13. Automation is not human review; no additional follow-up is planned without a reply. |
-| n8n | The support AI's promised human product/engineering follow-up had not arrived by the audit date. | Sent one short routing/status follow-up on 2026-08-13. No escalation or adoption is claimed, and no additional follow-up is planned without a reply. |
+| n8n | Senior support engineer Mo Hamdy supplied an actionable public route and technical constraints on 2026-08-13. | Drafted a reply that follows his guidance and converted the Markdown-It 13 peer/type incompatibility into BidiLens PR #57 with a strict packed 13/14 gate. The reply and community post are not recorded as sent. |
 | Jupyter, Zulip, Zed, Ollama, JetBrains, PostHog, Cohere, Supabase, Microsoft, and delivery systems | No new actionable human email response was found beyond the earlier audit. | No additional email was sent: these threads were already handled, routed to public channels, automated-only, unmonitored, rejected, or delivery failures. |
 
 The August 13 audit adds one maintainer backlog disposition and stronger hosted

docs/PUBLISHING.md

@@ -66,9 +66,10 @@ version.
 - verified `shayanay80` owner access to the `bidilens` npm organization and
   `@bidilens` scope;
 - identified bootstrap maintainer and CODEOWNERS;
-- strict `main` protection requires all 23 verification contexts: the 18 CI
-  jobs (including the Android library/sample build, API 35 UI-test gate, Apple
-  and Windows compiler gates, and three-platform Rust gate) plus five CodeQL
+- strict `main` protection requires all 24 verification contexts: the 19 CI
+  jobs (including the Markdown-It 13/14 packed compatibility gate, Android
+  library/sample build, API 35 UI-test gate, Apple and Windows compiler gates,
+  and three-platform Rust gate) plus five CodeQL
   language analyses for JavaScript/TypeScript, Kotlin, C#, Swift, and Rust. The
   branch must be up to date and use linear history, while force-pushes and
   branch deletion are blocked; repository administrators are also subject to
@@ -137,8 +138,9 @@ git status --short
 ```
 
 `verify:production` expands to the quality, three-browser visual, package type,
-dependency-audit, SBOM, and clean-release gate set that CI and release
-preparation enforce as separate steps.
+packed Markdown-It 13/14 compatibility, dependency-audit, SBOM, and
+clean-release gate set that CI and release preparation enforce as separate
+steps.
 
 `release:check` rejects a dirty tree, packs each public package, checks files
 and dependency protocols, installs all local tarballs into a temporary strict

docs/REQUIREMENT_MATRIX.md

@@ -39,7 +39,7 @@ Status vocabulary:
 | Surface | Status | Evidence or exact gap |
 |---|---|---|
 | Framework-independent TypeScript core | Complete and tested | `@bidilens/core`; dependency-free runtime; generated Unicode data; analysis, evidence, isolation, security, streaming |
-| unified/remark/rehype and markdown-it AST processing | Complete and tested | `@bidilens/markdown`; typed adapters, structural blocks, tables/lists/quotes/code/math, raw-HTML-safe defaults |
+| unified/remark/rehype and markdown-it AST processing | Complete and tested | `@bidilens/markdown`; typed adapters, structural blocks, tables/lists/quotes/code/math, raw-HTML-safe defaults; packed strict consumers verify identical 940-fixture behavior on Markdown-It 13.0.2 and 14.3.0 without leaking either host type line |
 | Plain HTML and DOM | Complete and tested | `@bidilens/html` and `@bidilens/dom`; escaped serialization, restore/observe lifecycle, cross-realm tests |
 | Web Component | Complete and tested | `@bidilens/web-component`; side-effect-free/SSR-safe main import, explicit `/auto` registration, self-contained browser bundle, three-browser load test |
 | React | Complete and tested | `@bidilens/react`; React 18/19 probes, SSR, components and streaming hook |