Add Vale rules for list numbering, step headings, and nested list indentation

.vale/styles/Smallstep/NestedListIndent.yml

@@ -0,0 +1,55 @@
+extends: script
+message: "Nested list item is not indented enough. Indent it to the column where the text of the parent item starts, or Markdown will not nest it."
+level: error
+scope: raw
+script: |
+  text := import("text")
+
+  matches := []
+  // stack holds the open list items, outermost first. For each item, indent
+  // is the column of its marker and content is the column where its text
+  // starts. A nested item must start at or after content.
+  stack := []
+  in_fence := false
+  offset := 0
+
+  for line in text.split(scope, "\n") {
+    trimmed := text.trim_space(line)
+    indent := len(line) - len(text.trim_left(line, " "))
+
+    if text.has_prefix(trimmed, "```") || text.has_prefix(trimmed, "~~~") {
+      in_fence = !in_fence
+    } else if in_fence || trimmed == "" {
+      // Fenced code and blank lines do not change list state.
+    } else if text.has_prefix(line, "#") {
+      stack = []
+    } else {
+      m := text.re_find(`^ *([-*+]|[0-9]+[.)])( +)\S`, line)
+      if m != undefined {
+        // Close the items at this indentation or deeper.
+        for len(stack) > 0 && indent <= stack[len(stack)-1].indent {
+          stack = stack[:len(stack)-1]
+        }
+        if len(stack) > 0 && indent < stack[len(stack)-1].content {
+          matches = append(matches, {
+            begin: offset + m[0][1].begin,
+            end: offset + m[0][1].end
+          })
+        }
+        stack = append(stack, {
+          indent: indent,
+          content: indent + len(m[0][1].text) + len(m[0][2].text)
+        })
+      } else if indent == 0 {
+        // Text at the left margin ends all lists.
+        stack = []
+      } else {
+        // Indented text ends the items that are not its parents.
+        for len(stack) > 0 && indent <= stack[len(stack)-1].indent {
+          stack = stack[:len(stack)-1]
+        }
+      }
+    }
+
+    offset += len(line) + 1
+  }

.vale/styles/Smallstep/OrderedListNumbering.yml

@@ -0,0 +1,80 @@
+extends: script
+message: "Numbered list is out of order. Number the items 1, 2, 3, ... without skipping or repeating a number."
+level: error
+scope: raw
+script: |
+  text := import("text")
+
+  matches := []
+  // expected[indent] is the next number for the list at that indentation.
+  expected := {}
+  // broken[indent] is true when other text came after the last item of the
+  // list at that indentation, so a new list may start there at 1.
+  broken := {}
+  in_fence := false
+  offset := 0
+
+  // Lists nested deeper than indent belong to the previous item: forget them.
+  forget_deeper := func(indent) {
+    for k, _ in expected {
+      if text.atoi(k) > indent {
+        delete(expected, k)
+        delete(broken, k)
+      }
+    }
+  }
+
+  // Text at indent interrupts the lists at that indentation and deeper.
+  interrupt := func(indent) {
+    for k, _ in expected {
+      if text.atoi(k) >= indent {
+        broken[k] = true
+      }
+    }
+  }
+
+  for line in text.split(scope, "\n") {
+    trimmed := text.trim_space(line)
+    indent := len(line) - len(text.trim_left(line, " \t"))
+
+    if text.has_prefix(trimmed, "```") || text.has_prefix(trimmed, "~~~") {
+      in_fence = !in_fence
+      interrupt(indent)
+    } else if in_fence || trimmed == "" {
+      // Fenced code and blank lines do not change list state.
+    } else if text.has_prefix(line, "#") {
+      // A heading starts a new section, so any list after it starts over.
+      expected = {}
+      broken = {}
+    } else {
+      m := text.re_find(`^[ \t]*([0-9]+)[.)][ \t]`, line)
+      if m != undefined {
+        num := text.atoi(m[0][1].text)
+        forget_deeper(indent)
+
+        key := string(indent)
+        want := expected[key]
+        // An item must follow the previous item at the same level. Item 1
+        // may start a new list when there is no list at this level or when
+        // other text separates it from the previous list.
+        ok := num == want || (num == 1 && (want == undefined || broken[key]))
+        if !ok {
+          matches = append(matches, {
+            begin: offset + m[0][1].begin,
+            end: offset + m[0][1].end
+          })
+        }
+        expected[key] = num + 1
+        broken[key] = false
+      } else if text.re_match(`^[-*+][ \t]`, trimmed) {
+        // A bullet item owns the lists nested under it, and it interrupts a
+        // numbered list at its own level.
+        forget_deeper(indent)
+        interrupt(indent)
+      } else {
+        interrupt(indent)
+      }
+    }
+
+    offset += len(line) + 1
+  }

.vale/styles/Smallstep/StepHeadingNumbering.yml

@@ -0,0 +1,52 @@
+extends: script
+message: "Step heading is out of order. Number the step headings 1, 2, 3, ... (or 0, 1, 2, ...) without skipping or repeating a number."
+level: error
+scope: raw
+script: |
+  text := import("text")
+
+  matches := []
+  // last[level] is the number of the last step heading at that heading level.
+  last := {}
+  in_fence := false
+  offset := 0
+
+  for line in text.split(scope, "\n") {
+    trimmed := text.trim_space(line)
+
+    if text.has_prefix(trimmed, "```") || text.has_prefix(trimmed, "~~~") {
+      in_fence = !in_fence
+    } else if !in_fence && text.has_prefix(line, "#") {
+      level := len(line) - len(text.trim_left(line, "#"))
+
+      // A higher-level heading starts a new section, so the step headings
+      // under it count from the start again.
+      for k, _ in last {
+        if text.atoi(k) > level {
+          delete(last, k)
+        }
+      }
+
+      m := text.re_find(`(?i)^#+[ \t]+(?:\*\*)?step[ \t]+([0-9]+)\b`, line)
+      if m != undefined {
+        num := text.atoi(m[0][1].text)
+        key := string(level)
+        prev := last[key]
+        ok := false
+        if prev == undefined {
+          ok = num == 0 || num == 1
+        } else {
+          ok = num == prev + 1
+        }
+        if !ok {
+          matches = append(matches, {
+            begin: offset + m[0][1].begin,
+            end: offset + m[0][1].end
+          })
+        }
+        last[key] = num
+      }
+    }
+
+    offset += len(line) + 1
+  }

ssh/azure-ad.mdx

@@ -88,7 +88,7 @@ Your Users and Groups list should now look something like this:
 
 1.  Choose **Provisioning** on the left and choose **Get Started**.
 2.  Set the provisioning mode to **Automatic**.
-4.  Expand **Admin Credentials:**
+3.  Expand **Admin Credentials:**
     * Supply the SCIM **Tenant URL** and **Secret Token** from the Smallstep console.
     * Choose **Test Connection** and make sure that it works.
 	* Save.

step-ca/certificate-authority-server-production.mdx

@@ -280,7 +280,7 @@ the CRL will be hosted at `/1.0/crl`.
         $(step path)/secrets/intermediate_ca_key
    ```
 
-2. Restart `step-ca`.
+3. Restart `step-ca`.
    Clients will be able to renew certificates that were issued by your previous Intermediate CA.
 
 #### Enable CRL for leaf certificates
@@ -305,7 +305,7 @@ the CRL will be hosted at `/1.0/crl`.
    Reload the configuration by restarting `step-ca` or sending it a `HUP` signal.
 
 
-1. Add an X.509 certificate template, and enable `crlDistributionPoints` in the template:
+2. Add an X.509 certificate template, and enable `crlDistributionPoints` in the template:
 
    ```bash
    cd $(step path)/templates
@@ -815,8 +815,8 @@ If you have PEM bundles containing both your root and intermediate CAs, you will
 1. **Create your new intermediate CA** certificate and key, but do not start issuing certificates with it yet.
 2. **Append the new intermediate certificate** to the bundles that need it.
 3. **Configure `step-ca` to use your new intermediate**.
-3. **Wait** for all certificates issued by the old intermediate to expire.
-3. It is now safe to **remove the old intermediate from the bundles**.
+4. **Wait** for all certificates issued by the old intermediate to expire.
+5. It is now safe to **remove the old intermediate from the bundles**.
 
 ## Sane cryptographic defaults
 

step-ca/provisioners.mdx

@@ -1108,18 +1108,18 @@ step ca provisioner add acme-da \
 
 To get a client certificate for a hardware-bound private key on your YubiKey:
 
-0. Create a `device-attest-01` provisioner as described above.
-1. Install [`step-kms-plugin`](https://github.com/smallstep/step-kms-plugin/)
-2. Insert the YubiKey.
-3. Generate a private key in one of the YubiKey's slots, if you haven't already.
+1. Create a `device-attest-01` provisioner as described above.
+2. Install [`step-kms-plugin`](https://github.com/smallstep/step-kms-plugin/)
+3. Insert the YubiKey.
+4. Generate a private key in one of the YubiKey's slots, if you haven't already.
    In this example, we'll use slot `9a`.
    Run:
 
    ```bash
    step kms create 'yubikey:slot-id=9a' \
        --kms 'yubikey:?pin-value=123456'
    ```
-4. Get a certificate for the YubiKey from `step-ca`.
+5. Get a certificate for the YubiKey from `step-ca`.
    Substitute the serial number of your YubiKey here:
 
    ```bash