Carry the span fixes to npm and the site

CHANGELOG.md

@@ -7,6 +7,13 @@ versioning follows [SemVer](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.0.2-beta.5] — 2026-09-13
+
+The last beta of the 0.0.2 line. Every grammar had picked one of two
+failures — a quote inside a comment, or a comment marker inside a string —
+because its rules ran in a fixed order; spans now compete by position instead.
+Also templates nested in placeholders, and private class members.
+
 ### Fixed
 
 - **A comment may hold a quote, and a string a comment marker, in the same

README.md

@@ -9,7 +9,7 @@
 
 [![npm](https://img.shields.io/npm/v/@jsray/core/beta?label=npm)](https://www.npmjs.com/package/@jsray/core)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-0.0.2--beta.4-lightgrey)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.0.2--beta.5-lightgrey)](CHANGELOG.md)
 [![Channel](https://img.shields.io/badge/channel-beta-blue)](docs/versioning.md)
 [![Zero deps](https://img.shields.io/badge/dependencies-0-success)](package.json)
 [![Size](https://img.shields.io/badge/dist-core%20js%20%2B%20css-lightgrey)](dist/)
@@ -46,7 +46,7 @@ Or drop it into a page with no build step at all:
 watching, pin the version instead** — every release is frozen at its own path:
 
 ```html
-<script src="https://jsray.org/v/0.0.2-beta.4/jsray.js"></script>
+<script src="https://jsray.org/v/0.0.2-beta.5/jsray.js"></script>
 ```
 
 ### Verifying what you loaded
@@ -56,15 +56,15 @@ A pinned URL says which release you asked for, not which bytes you got. Add a
 hash and the browser refuses to run the file if it is not the one published:
 
 ```html
-<script src="https://jsray.org/v/0.0.2-beta.4/jsray.js"
+<script src="https://jsray.org/v/0.0.2-beta.5/jsray.js"
         integrity="sha256-…"
         crossorigin="anonymous"></script>
 ```
 
 The hashes live next to the files they describe, in the same format SRI uses:
 
 ```
-https://jsray.org/v/0.0.2-beta.4/integrity.json
+https://jsray.org/v/0.0.2-beta.5/integrity.json
 ```
 
 `crossorigin="anonymous"` is required, not optional — SRI on a cross-origin

README.zh-CN.md

@@ -9,7 +9,7 @@
 
 [![npm](https://img.shields.io/npm/v/@jsray/core/beta?label=npm)](https://www.npmjs.com/package/@jsray/core)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-0.0.2--beta.4-lightgrey)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.0.2--beta.5-lightgrey)](CHANGELOG.md)
 [![Channel](https://img.shields.io/badge/channel-beta-blue)](docs/versioning.md)
 [![Zero deps](https://img.shields.io/badge/dependencies-0-success)](package.json)
 [![Size](https://img.shields.io/badge/dist-core%20js%20%2B%20css-lightgrey)](dist/)
@@ -45,7 +45,7 @@ JSRay.highlight('const x = 42;', 'js');
 `jsray.org/dist/` 始终提供当前发布版本。**线上站点如果你不会持续盯着,请改用锁定版本的地址** —— 每个发布版本都固化在自己的路径下,永不变动:
 
 ```html
-<script src="https://jsray.org/v/0.0.2-beta.4/jsray.js"></script>
+<script src="https://jsray.org/v/0.0.2-beta.5/jsray.js"></script>
 ```
 
 ### 校验你加载到的东西
@@ -55,15 +55,15 @@ JSRay.highlight('const x = 42;', 'js');
 哈希,浏览器在文件与发布内容不符时会直接拒绝执行:
 
 ```html
-<script src="https://jsray.org/v/0.0.2-beta.4/jsray.js"
+<script src="https://jsray.org/v/0.0.2-beta.5/jsray.js"
         integrity="sha256-…"
         crossorigin="anonymous"></script>
 ```
 
 哈希就放在它所描述的文件旁边,格式与 SRI 完全一致:
 
 ```
-https://jsray.org/v/0.0.2-beta.4/integrity.json
+https://jsray.org/v/0.0.2-beta.5/integrity.json
 ```
 
 `crossorigin="anonymous"` 是必需的,不是可选:跨源脚本的 SRI 只有在加载走

SECURITY.md

@@ -43,8 +43,8 @@ one.
 
 | Version | Security updates |
 |---|---|
-| 0.0.2-beta.4 | ✅ Current public beta |
-| 0.0.2-beta.1 – beta.3 | ❌ Superseded — upgrade to the current beta |
+| 0.0.2-beta.5 | ✅ Current public beta |
+| 0.0.2-beta.1 – beta.4 | ❌ Superseded — upgrade to the current beta |
 | Earlier betas | ❌ Superseded — upgrade to the current beta |
 | 0.0.1-internal.∗ | ❌ Superseded by the public beta |
 | Stable | Not yet released |

demo/index.html

@@ -357,7 +357,7 @@ <h3>Project</h3>
   </div>
 
   <div class="site-footer__base">
-    <p>© 2026 JSRay · MIT · <code data-jsray-version>0.0.2-beta.4</code></p>
+    <p>© 2026 JSRay · MIT · <code data-jsray-version>0.0.2-beta.5</code></p>
     <p>Made by Jie</p>
   </div>
 </footer>

demo/studio.html

@@ -112,7 +112,7 @@ <h3>Project</h3>
   </div>
 
   <div class="site-footer__base">
-    <p>© 2026 JSRay · MIT · <code data-jsray-version>0.0.2-beta.4</code></p>
+    <p>© 2026 JSRay · MIT · <code data-jsray-version>0.0.2-beta.5</code></p>
     <p>Made by Jie</p>
   </div>
 </footer>

dist/jsray.js

@@ -2147,7 +2147,7 @@
      * Runtime version, for shell/core compatibility negotiation.
      * Must match version.json — tools/check-versions.mjs asserts it.
      */
-    version: '0.0.2-beta.4',
+    version: '0.0.2-beta.5',
     languages: G,
     normalizeLanguage,
     detectLanguage,

docs/projects.md

@@ -76,7 +76,7 @@ wait for the next feature release — cut the integration release for it.
 
 | Repository | Intended channel | Licence | Available from today |
 |---|---|---|---|
-| `jsray` | npm `@jsray/core` | MIT | npm — `@jsray/core@0.0.2-beta.4` |
+| `jsray` | npm `@jsray/core` | MIT | npm — `@jsray/core@0.0.2-beta.5` |
 | `jsray-wp` | WordPress.org plugin | GPLv2 or later | GitHub release zip |
 | `jsray-terminal` | npm CLI | MIT | GitHub — `npm i -g github:jsrayorg/jsray-terminal` |
 | `jsray-vscode` | VS Code Marketplace | MIT | GitHub release `.vsix` |
@@ -107,7 +107,7 @@ The public website keeps the brand concentrated under `jsray.org`:
   moves on every release, which is right for the demo and wrong for a site
   nobody is watching.
 - `https://jsray.org/v/<version>/`: the same files frozen per release
-  (`jsray.org/v/0.0.2-beta.4/jsray.js`). A page that pins here keeps rendering
+  (`jsray.org/v/0.0.2-beta.5/jsray.js`). A page that pins here keeps rendering
   the way it did the day it was written.
 
 `tools/build-site.sh` emits both. Cloudflare replaces the whole asset bundle on

docs/projects.zh-CN.md

@@ -72,7 +72,7 @@ tag 附带的源码包，一概如此 —— 所以一个在 Core 发布当下
 
 | 仓库 | 交付形态 | 许可 | 今天从哪里拿到 |
 |---|---|---|---|
-| `jsray` | npm `@jsray/core` | MIT | npm —— `@jsray/core@0.0.2-beta.4` |
+| `jsray` | npm `@jsray/core` | MIT | npm —— `@jsray/core@0.0.2-beta.5` |
 | `jsray-wp` | WordPress.org 插件 | GPLv2 or later | GitHub Release 的 zip |
 | `jsray-terminal` | npm CLI | MIT | GitHub —— `npm i -g github:jsrayorg/jsray-terminal` |
 | `jsray-vscode` | VS Code Marketplace | MIT | GitHub Release 的 `.vsix` |
@@ -98,7 +98,7 @@ GPLv2 or later,因为 WordPress.org 的第一条指南接受任何 GPL 兼容许
   (`jsray.org/dist/jsray.js`、`jsray.org/dist/themes/<name>.css`)。这个路径每次
   发版都会变 —— 对演示页是对的，对没人盯着的站点是错的。
 - `https://jsray.org/v/<version>/`：同样的文件按版本固化
-  (`jsray.org/v/0.0.2-beta.4/jsray.js`)。锁定到这里的页面，今天怎么渲染，
+  (`jsray.org/v/0.0.2-beta.5/jsray.js`)。锁定到这里的页面，今天怎么渲染，
   以后还怎么渲染。
 
 `tools/build-site.sh` 两者都生成。Cloudflare 每次部署都会整体替换资产包，因此

docs/versioning.md

@@ -4,7 +4,7 @@
 
 JSRay Core uses single-project versioning. Platform plugins keep their own version files in their own repositories.
 
-Current version: `0.0.2-beta.4`
+Current version: `0.0.2-beta.5`
 Current channel: `beta`
 Public beta released: yes
 
@@ -33,7 +33,7 @@ The mechanics follow from that: `check:versions` requires the counter here, and
 `0.0.2`.
 
 ```
-0.0.1-beta.1 … 0.0.1-beta.5 → 0.0.2-beta.1 … 0.0.2-beta.4 → 0.0.3-beta.1 → … → 0.1.0
+0.0.1-beta.1 … 0.0.1-beta.5 → 0.0.2-beta.1 … 0.0.2-beta.5 → 0.0.3-beta.1 → … → 0.1.0
 ```
 
 The `0.0.1` line closed at beta.5. `0.1.0` is where the beta label comes off,

docs/versioning.zh-CN.md

@@ -4,7 +4,7 @@
 
 JSRay Core 采用单项目版本号。平台插件在各自仓库里维护自己的版本文件。
 
-当前版本:`0.0.2-beta.4`
+当前版本:`0.0.2-beta.5`
 当前通道:`beta`
 公开测试版已发布:是
 
@@ -30,7 +30,7 @@ JSRay Core 是独立的 JavaScript 原生代码渲染内核。平台插件(包
 `version_compare()` —— 字符串排序会把 `0.0.10` 排在 `0.0.2` 前面。
 
 ```
-0.0.1-beta.1 … 0.0.1-beta.5 → 0.0.2-beta.1 … 0.0.2-beta.4 → 0.0.3-beta.1 → …… → 0.1.0
+0.0.1-beta.1 … 0.0.1-beta.5 → 0.0.2-beta.1 … 0.0.2-beta.5 → 0.0.3-beta.1 → …… → 0.1.0
 ```
 
 `0.0.1` 这条线在 beta.5 结束。`0.1.0` 才是脱掉 beta 标签的地方,因此 `0.0.1`

integrity.json

@@ -1,10 +1,10 @@
 {
   "project": "jsray",
-  "version": "0.0.2-beta.4",
+  "version": "0.0.2-beta.5",
   "algorithm": "sha256",
   "note": "Base64 SHA-256 digests of the released Core assets. Integrations copy the relevant digest at sync time and verify their bundled snapshot against it.",
   "files": {
-    "dist/jsray.js": "sha256-KOSefuYNXQrhcQMaV4c25TpTRhgUMtNgX5WvtT3NGGc=",
+    "dist/jsray.js": "sha256-BpK2KQgvKwOAPOuu08eMtlhIS03AcylLErLEiH1EEQc=",
     "dist/jsray.css": "sha256-6Fuva+aZwCcmltNi2oN+1yWIJoKE+1rLpUxZvD9iutc=",
     "dist/themes/aurora.css": "sha256-S8X+R8XZNC8WRdHOen839zMkPxVFol6PPTrpZibbeJA=",
     "dist/themes/default.css": "sha256-vENOigRjwn1hW6wPjdM4tbZ58Ja44FMsa+akavPiMSI=",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsray/core",
-  "version": "0.0.2-beta.4",
+  "version": "0.0.2-beta.5",
   "description": "JavaScript-native code rendering kernel with 23-class token semantics and pluggable themes.",
   "author": "Jie <jie@jsray.org>",
   "license": "MIT",

src/jsray.js

@@ -2147,7 +2147,7 @@
      * Runtime version, for shell/core compatibility negotiation.
      * Must match version.json — tools/check-versions.mjs asserts it.
      */
-    version: '0.0.2-beta.4',
+    version: '0.0.2-beta.5',
     languages: G,
     normalizeLanguage,
     detectLanguage,

tokens.json

@@ -1,7 +1,7 @@
 {
   "name": "JSRay",
   "author": "Jie",
-  "version": "0.0.2-beta.4",
+  "version": "0.0.2-beta.5",
   "description": "Default palette · 23 token classes · 6 identifier families visually separated",
   "philosophy": {
     "identifier-families": {

types/jsray.d.ts

@@ -39,7 +39,7 @@ declare namespace JSRay {
   /** A renderer-agnostic stream produced by `tokenize`. */
   type TokenStream = Array<string | Token>;
 
-  /** Runtime version string, matches version.json (e.g. "0.0.2-beta.4"). */
+  /** Runtime version string, matches version.json (e.g. "0.0.2-beta.5"). */
   const version: string;
 
   /** Grammars for every registered language, keyed by name and by alias. */

version.json

@@ -1,7 +1,7 @@
 {
   "project": "jsray",
   "name": "JSRay Core",
-  "version": "0.0.2-beta.4",
+  "version": "0.0.2-beta.5",
   "channel": "beta",
   "publicBetaReleased": true,
   "notes": "Standalone JavaScript-native code rendering kernel. JSRay is planned as a fully open-source ecosystem with Core, official integrations, and community integrations."

vocabulary.json

@@ -1,6 +1,6 @@
 {
   "project": "jsray",
-  "version": "0.0.2-beta.4",
+  "version": "0.0.2-beta.5",
   "description": "Machine-readable token vocabulary: the three-name lock-step every JSRay surface shares. A palette key maps to one CSS custom property (--jr-<suffix>) and one runtime class (tk-<suffix>).",
   "tokens": {
     "keyword": "keyword",