Current authoritative state
Protected shipped truth is exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. The original unbounded htmlToMarkdown() parser-materialization defect is repaired on consolidated Draft PR #176 / branch fix/public-markdown-resource-options-175, which is the sole active writer for this overlapping Markdown reliability surface and explicitly Closes #169. At this issue synchronization, the exact Draft head is 68aa1ed4f08e2c65826dccb02ca8f3e2da3a9407; live PR/head and independently resolved protected main remain lifecycle authority.
Implemented active-PR contract
HtmlToMarkdownOptions.maxHtmlBytes accepts an optional positive safe integer, defaults to 16 MiB, and rejects configured values above the 64 MiB hard maximum. Accepted primitive-string input is checked first by a UTF-16 code-unit lower bound and then, where necessary, by exact UTF-8 byte length before browser template or browserless Turndown parser materialization. Oversized input fails through the payload-redacted HtmlToMarkdownResourceError / input_too_large contract. Non-string runtime input uses the stable invalid_input category before caller property access, encoding, DOM materialization, or parser work.
The public runtime option bag is also fail-closed: ordinary/null-prototype enumerable data properties are accepted for the supported keys; accessor-backed properties are rejected without invoking their getters; unknown/symbol/non-enumerable properties, malformed values, exotic prototypes, and hostile reflection failures normalize to invalid_configuration. JavaScript Proxy meta-object reflection may itself execute Proxy traps, so no contrary no-caller-code claim is made; private thrown values are normalized/redacted.
Accepted includeImageAlt, safe-link, strict inline-raster, Markdown output, browserless package, SSR/browser/Office, and deterministic standalone behavior remain preserved. This adds no transport, persistence, authorization, tenancy, credentials, network, model/provider, deployment, migration, retention, durable-audit, or collaboration authority.
Verification / integration boundary
#176 contains the executable parser-allocation, runtime-option-bag, non-string-input, exact-boundary, UTF-8-accounting, package-consumer and coverage tests for this contract. Current exact-head repository evidence must be read live and predecessor evidence must not transfer; the PR remains Draft and unmerged.
Keep this issue open until #176 integrates into protected main under then-live governance. While #118 owns exact protected v0.6.0 publication/provenance acceptance, do not advance #176 into protected main, force-push/destructively rebase it, revive superseded resource-bound writers, weaken gates, or represent this active-PR behavior as shipped.
Current authoritative state
Protected shipped truth is exact
main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. The original unboundedhtmlToMarkdown()parser-materialization defect is repaired on consolidated Draft PR #176 / branchfix/public-markdown-resource-options-175, which is the sole active writer for this overlapping Markdown reliability surface and explicitlyCloses #169. At this issue synchronization, the exact Draft head is68aa1ed4f08e2c65826dccb02ca8f3e2da3a9407; live PR/head and independently resolved protected main remain lifecycle authority.Implemented active-PR contract
HtmlToMarkdownOptions.maxHtmlBytesaccepts an optional positive safe integer, defaults to 16 MiB, and rejects configured values above the 64 MiB hard maximum. Accepted primitive-string input is checked first by a UTF-16 code-unit lower bound and then, where necessary, by exact UTF-8 byte length before browser template or browserless Turndown parser materialization. Oversized input fails through the payload-redactedHtmlToMarkdownResourceError/input_too_largecontract. Non-string runtime input uses the stableinvalid_inputcategory before caller property access, encoding, DOM materialization, or parser work.The public runtime option bag is also fail-closed: ordinary/null-prototype enumerable data properties are accepted for the supported keys; accessor-backed properties are rejected without invoking their getters; unknown/symbol/non-enumerable properties, malformed values, exotic prototypes, and hostile reflection failures normalize to
invalid_configuration. JavaScript Proxy meta-object reflection may itself execute Proxy traps, so no contrary no-caller-code claim is made; private thrown values are normalized/redacted.Accepted
includeImageAlt, safe-link, strict inline-raster, Markdown output, browserless package, SSR/browser/Office, and deterministic standalone behavior remain preserved. This adds no transport, persistence, authorization, tenancy, credentials, network, model/provider, deployment, migration, retention, durable-audit, or collaboration authority.Verification / integration boundary
#176 contains the executable parser-allocation, runtime-option-bag, non-string-input, exact-boundary, UTF-8-accounting, package-consumer and coverage tests for this contract. Current exact-head repository evidence must be read live and predecessor evidence must not transfer; the PR remains Draft and unmerged.
Keep this issue open until #176 integrates into protected main under then-live governance. While #118 owns exact protected
v0.6.0publication/provenance acceptance, do not advance #176 into protected main, force-push/destructively rebase it, revive superseded resource-bound writers, weaken gates, or represent this active-PR behavior as shipped.