@quillmark/wasm 0.97.0 → 0.99.0

package/CHANGELOG.md

@@ -1,5 +1,308 @@
 # Changelog
 
+## v0.99.0 - 2026-08-01
+
+The 1.0.0 API freeze lands ahead of the tag, and the content codec closes its
+last open gaps. All breaking changes are covered by
+`docs/migrations/0.98-to-0.99.md`. Stored documents are unaffected: a `0.98` blob
+loads byte-identically and `0.99` writes the same bytes for the same content.
+
+- refactor(core,content,pdf,pdfform)!: the public API opens. 75 public types take
+  `#[non_exhaustive]` — nothing in the workspace carried it before — so an
+  exhaustive `match` needs a `_` arm and a struct literal gives way to `new` plus
+  `with_*` setters. `Backend` is sealed, `OutputFormat::ALL` and
+  `Content::RESERVED_{MARK_TYPES,LINE_KINDS,CONTAINERS}` become slices, and
+  `RenderOptions { .., ..Default::default() }` becomes
+  `RenderOptions::default().with_output_format(fmt)`. Four stay exhaustive and
+  say so: the storage DTOs, frozen per schema version, plus
+  `quillmark_pdf::FieldType`, `KnownIslandType`, and `Fidelity`, where an
+  out-of-crate `_` arm is silent (a field that draws nothing, an island dropped
+  from the projection, a fidelity rung nothing warns about). The rules are
+  canonized in `prose/canon/COMPATIBILITY.md` (#1090, #1103). See
+  `docs/migrations/0.98-to-0.99.md`
+- refactor(core)!: the YAML engine leaves the public API. `QuillValue::from_yaml_str`
+  and `QuillConfig::schema_yaml` return `quillmark_core::YamlError` instead of
+  `serde_saphyr` types, so a `0.0.x` dependency release is no longer a break to
+  `quillmark-core`. The message is sanitized (the engine's own Rust API names are
+  stripped), and `from_yaml_str` gains the `MAX_YAML_DEPTH` budget its siblings
+  already carried (#1099, #1101). See `docs/migrations/0.98-to-0.99.md`
+- fix(content)!: the reserved-name rule reaches the wire. `attrs` beside a
+  built-in discriminator resolved to the built-in and dropped the payload in
+  silence; the authored lane now refuses it on all four axes, where a host writes
+  it. Reading never got stricter — a blob from before a promotion still opens.
+  A table cell keeps its own unknown keys too, canonicalization now rewriting it
+  in place rather than minting a fresh `{text, marks}` (#1084, #1085, #1086,
+  #1092). See `docs/migrations/0.98-to-0.99.md`
+- fix(content)!: opaque payload depth is bounded at `MAX_JSON_DEPTH` (128) on the
+  `Value` lane, where an unbounded one took the WASM module down with a
+  stack-overflow trap rather than a catchable error. The WASM guard sits on the
+  JS side of the boundary, since `serde_wasm_bindgen` recurses while building the
+  value, and covers every door that takes opaque host JSON: `install` and
+  `applyChange`, plus `makeCard`'s field values and `insertCard`'s payload items
+  (#1093). See `docs/migrations/0.98-to-0.99.md`
+- fix(content)!: island `loss` becomes the fifth open set. An unrecognized class
+  round-trips verbatim instead of being rewritten to `unrepresentable`, so merely
+  opening a document no longer moves its content hash. `Loss` opens on the island
+  `type` axis' terms rather than the block axes': it becomes an opaque string
+  wrapper with `LOSSLESS` / `DEGRADED` / `UNREPRESENTABLE` consts, one value per
+  wire string, so a built-in's name has no second spelling and needs no
+  reserved-name rule. `Fidelity` is the closed view `Loss::fidelity` returns, and
+  is where a consumer switches; `Loss` consequently loses its `Copy` derive
+  (#1091, #1142). See `docs/migrations/0.98-to-0.99.md`
+- refactor(core,typst,pdf)!: workspace-internal seams leave the published
+  surface. `quillmark-pdf`'s `reader`/`writer` modules and `quillmark_typst::emit`
+  become `#[doc(hidden)]`; the op-wire encoders emit an unknown's `attrs` in
+  caller key order, the redundant per-encoder sort having been dropped (canonical
+  content bytes are unchanged, the terminal sort still running) (#1095). See
+  `docs/migrations/0.98-to-0.99.md`
+- fix(wasm)!: a `Quill` or `Document` from a second copy of `@quillmark/wasm` is
+  refused everywhere, as a `QuillmarkError` coded `runtime::foreign_handle` that
+  names the cause and hints `npm ls @quillmark/wasm`. 0.98 half-worked there:
+  `Engine` was duck-typed, so a quill from copy A rendered on an engine from copy
+  B at a per-copy clone cache nobody could see, while `Document.equals`,
+  `Quill.validate`, `Quill.resolve` and the typed writer met wasm-bindgen's bare
+  `expected instance of Document` at a value that *is* a `Document`. The check
+  covers `Engine` (`render`, `open`, `supportedFormats`, `supportsCanvas`),
+  `LiveSession.apply`, the writer and reader binds, and the three by-reference
+  core methods; a value that is not a handle at all keeps its own
+  `runtime::not_a_document` / `runtime::not_a_quill`. Nothing changes for a
+  one-copy install (#1132, #1136). See `docs/migrations/0.98-to-0.99.md`
+- feat(wasm): `isUnknownLine` / `isUnknownContainer` / `isUnknownMark` /
+  `isUnknownIsland` answer known-vs-unknown on each open set, so a consumer no
+  longer enumerates built-in names in its own source. `ContentLineKind` is
+  re-exported from the package entry point, so a `setKind` op type-checks without
+  a cast
+- feat(python): the Tier-1 gaps close. `doc.card(i)`, `doc.card_index_by_id(id)`,
+  and `doc.seed_overlay(kind)` are the single-card, `$id`, and seed reads WASM
+  already had, and the wheel ships `py.typed` plus stubs, so mypy and Pyright see
+  real signatures where the surface used to resolve to `Any` (#1011)
+- fix(typst): four quill-load defects — a skipped asset, an unparseable
+  `typst.toml`, a skipped package file, a declared-but-absent entrypoint —
+  become `RenderResult` warnings (`typst::path_skipped`,
+  `typst::package_manifest`, `typst::package_entrypoint_missing`) instead of
+  `eprintln!` that wasm32 has nowhere to print (#1102)
+- fix(wasm): the npm package states the license the workspace actually grants.
+  `package.json` declared `MIT OR Apache-2.0` where every Rust crate, the
+  workspace manifest, and the only `LICENSE` file in the tree are `Apache-2.0`,
+  and the package shipped no license text at all: `build-wasm.sh` copied
+  `LICENSE-MIT` and `LICENSE-APACHE`, neither of which exists. It now copies
+  `LICENSE`, or refuses to produce a package
+- ci: the release gates the tag actually needs. New `package` (builds every
+  publishable crate from its own archive and asserts each ships its `LICENSE`),
+  `msrv` (holds `rust-version` to something true), and `audit` (bare `cargo
+  audit` over the lockfile) jobs; the workspace moves to edition 2024 and
+  declares MSRV 1.92. The `semver` job is dropped — it compared the tree's
+  unbumped version against itself — and `COMPATIBILITY.md` names the writer and
+  reviewer as what holds the promise instead (#1105, #1106, #1107, #1108)
+- ci: the rustdoc gate covers the whole workspace. A bare `cargo doc` walks
+  default-members and never lints a crate outside it — the blind spot that let
+  the `Delta` links rot on the WASM surface and four more in the published
+  `quillmark-content`. `--workspace` needs no `--exclude` and covers the next
+  such crate on the day it lands
+- test(fuzz): the four JSON decode lanes the bindings expose gain coverage
+  (#1104)
+- docs(canon): `COMPATIBILITY.md` states the crate-API promise — what
+  `#[non_exhaustive]` does and does not buy, when to mark an enum, and what no
+  attribute sweep catches
+- docs(all): the em-dash leaves comments and prose, folded to a colon, comma,
+  semicolon, or parentheses across ~2900 sites. `dense-prose` banned it while
+  every exemplar it named used it; the corpus now matches the rule. A handful of
+  diagnostic and CLI message strings repunctuate with it (`edit::body_only`,
+  `validation::must_fill`, the pdfform bind errors, `--help`); codes, severities,
+  and paths are unchanged. The character stays where it is the subject rather
+  than punctuation: the WinAnsi encoding table, the YAML en/em-dash fixtures, and
+  `docs/migrations/` (#1135)
+- chore(core): `serde-saphyr` moves to `1.0`. The two call sites that built
+  `Options`/`SerializerOptions` with struct-literal-plus-`..Default::default()`
+  now go through the crate's own `options!`/`ser_options!`/`budget!` macros,
+  which the 1.0 release requires since both structs are `#[non_exhaustive]`.
+  `serde_saphyr` types stay out of `quillmark-core`'s public API (see the YAML
+  engine entry above), so nothing downstream moves
+
+<!-- seed: commits since v0.98.0, confirm the entries above cover them, then delete this comment
+- chore(core): move the time format descriptions to parse_borrowed::<3>
+- build(deps): bump lopdf from 0.42.0 to 0.44.0
+- build(deps): bump thiserror in the cargo group across 1 directory
+- build(deps): bump taiki-e/install-action
+- chore(core): bump serde-saphyr to 1.0
+- Split lint back out of test
+- Link every shipped artifact in CI, and carry v0.99.0's notes forward
+- dense-prose pass over the CI scope
+- Cut CI to one job per shipped surface
+- Stop the release from pushing to a branch that takes only PRs
+- Fix three claims the independent review falsified
+- Correct the release notes' exhaustive-type count
+- dense-prose pass over the review's scope
+- Close the two payload doors the depth guard missed
+- Ship the license the workspace actually grants
+- Correct the release docs against the tree they describe
+- CLAUDE.md: tighten the Tests section to house voice
+- CLAUDE.md: drop `uv run` from the Python binding flow
+- CLAUDE.md: gate local binding builds, name the cheap profiles
+- chore(release): v0.99.0
+- Split serial.rs's fixed-point claim into the two it conflated
+- Make Fidelity the one place a loss class is spelled
+- Make an island's loss class injective instead of guarded
+- dense-prose and simplify passes over the handle-check work
+- Keep the colon out of embedded YAML values
+- Sweep the em-dash out of comments and prose
+- Refuse a core handle from a second copy, everywhere
+- Replace the em-dash ban with the rule the exemplars follow
+- dense-prose pass over the foreign-handle prose
+- Extend the policy to the writer/reader lane, and draw the read/write line
+- Keep the patched method names, and stop over-claiming in the warning
+- Tolerate foreign core handles on the by-reference methods
+- Correct the quill file-size cap doc and MiB units
+- Collapse the rustdoc gate onto --workspace
+- dense-prose pass over the release-readiness fixes
+- Close the release-readiness gaps found against v0.98.0
+- Drop the semver job
+- Trim the Python typing work to its load-bearing parts
+- Revert "Record KnownIslandType::ALL's slice shape in the 0.99 guide"
+- Record KnownIslandType::ALL's slice shape in the 0.99 guide
+- Close the Python Tier-1 gaps: single-card reads and a typed surface
+- Drop the top-level-await plugin the vite 8 test config cannot load
+- Shape the reserved-name lists as slices
+- Shape the island ALL as a slice; list the 0.99 guide as published
+- Prune rottable duplication from CLAUDE.md
+- Adopt the editor's dense-prose rewrite; compress CLAUDE.md
+- build(deps): bump the cargo group across 1 directory with 12 updates
+- build(deps): bump the actions group across 1 directory with 11 updates
+- build(deps): bump tsify from 0.4.5 to 0.5.6
+- build(deps): bump toml from 0.8.23 to 1.1.3+spec-1.1.0
+- build(deps): bump similar from 2.7.0 to 3.1.1
+- build(deps): bump serde-saphyr from 0.0.23 to 0.0.29
+- Run the semver job on release PRs, not on every one
+- Drop the dead check-cfg rustflag that crashed the semver job
+- docs: dense-prose pass over the new test comments
+- dense-prose pass over the branch
+- Gate the compatibility promise mechanically, and write it down
+- test(bindings): cover the WASM and Python exports nothing exercised
+- Close the struct half of the 1.0.0 non_exhaustive sweep, and seal Backend
+- test(pdfform): drive unbound text/checkbox/choice through the fixture
+- Move the workspace to edition 2024
+- build(deps-dev): bump vitest in /crates/bindings/wasm
+- build(deps-dev): bump typescript in /crates/bindings/wasm
+- prose: drop the readiness proposal and SECURITY.md
+- ci: drop the Windows matrix from the test job
+- Finish the coerce_value_strict cleanup in the fuzz crate
+- dense-prose pass across the code and docs
+- Revert the wasm job to `npm install`
+- Trim CI to the checks v1.0.0 actually needs
+- Cut the two CI costs that buy nothing
+- Clear the RUSTSEC vulnerabilities the audit job actually found
+- Pin the tree to LF so the Windows runner reads what the test wrote
+- Cleanup pass: cut the machinery the fix did not need
+- prose: record what landed against the v1.0.0 readiness findings
+- fuzz: cover the four JSON decode lanes the bindings expose
+- Declare and hold an MSRV
+- Ship the license text, verify the packages, scan the dependencies
+- Open the engine crates' public enums ahead of the 1.0.0 freeze
+- Hide the workspace-internal seams from the published surface
+- typst: quill-load defects become session warnings, not stderr
+- core: own the YAML boundary error, and budget the third entry point
+- prose: index the v1.0.0 readiness findings against their issues
+- prose: v1.0.0 production-readiness review
+- Drop issue markers; dense-prose the unreleased 0.99 guide
+- dense-prose pass over the PR 1097 scope
+- docs: record the op-wire key-order change in the unreleased guide
+- content: carry the `<u>` bit on the event, not in a shared set
+- content: one key sorter for the canonical form
+- content: bound opaque JSON payload depth on the Value lane
+- content: make a vocabulary promotion carry its own legacy form
+- content: simplify pass over the codec-gap changes
+- content: house voice on the codec-gap comments
+- content: close the three v1.0.0 codec gaps before the freeze
+- content: cut the enumerated halves of the two open-set tests
+- content: prune tests that assert what a neighbour already pins
+- content: fold the authored-lane scan into the shared cell walk
+- content: split the wire lanes on reserved-name reuse (#1084, #1085, #1086)
+- docs: trim the migration index to a routing table; drop duplicate links
+- refactor(typst): re-export span_scan/extract instead of forwarding
+-->
+
+
+## v0.98.0 - 2026-07-28
+
+Five breaking changes, all covered by `docs/migrations/0.97-to-0.98.md`.
+Stored documents are unaffected: a `0.97` blob loads byte-identically and
+`0.98` writes the same bytes for the same content.
+
+- feat(core,content,wasm)!: the block vocabulary opens. A line's `kind` and a
+  container's name join the mark `type` and island `type` as open sets — an
+  unrecognized value round-trips opaque and renders as its nearest safe
+  neighbor instead of failing the load, so adding a block construct is no
+  longer a document schema-version event. `LineKind` and `Container` each gain
+  an `Unknown { tag, attrs }` variant (exhaustive matches need an arm) and
+  `Line` / `LineKind` / `Container` drop their `Eq` derive, matching `MarkKind`;
+  `Invariant` gains `ReservedUnknownLineKind` / `ReservedUnknownContainer`, so
+  an unknown may not reuse a built-in name. `ContentLine.kind` and
+  `ContentContainer.container` gain an open TS arm, so a bare discriminant check
+  no longer narrows — `isHeadingLine` / `isCodeLine` / `isListItemContainer`
+  join the existing guards in `@quillmark/wasm/runtime`. `Loss` describes
+  fidelity; it does not gate export (#1054). See
+  `docs/migrations/0.97-to-0.98.md`
+- refactor(core,wasm,python,cli)!: `OutputFormat::Txt` is removed — the Rust
+  variant, Python's `OutputFormat.TXT`, the TS `'txt'` arm. No backend listed it
+  in `SUPPORTED_FORMATS`, so every path reaching it failed at render time;
+  `--format txt` and `from_str("txt")` now fail at the argument instead, and
+  there is no replacement format (#1058). See
+  `docs/migrations/0.97-to-0.98.md`
+- refactor(typst,pdfform)!: `format_not_supported` was three codes for one
+  condition. Both backends now emit `backend::format_not_supported`, alongside
+  the sibling `backend::apply_unsupported` — route on the namespaced code
+  (#1057). See `docs/migrations/0.97-to-0.98.md`
+- refactor(core)!: dead public surface is removed — `ReadValue::as_text` /
+  `as_value` (match the variants), `Quill::list_files` / `list_subdirectories`
+  (`quill.files()` owns the walk), and `QuillValue`'s eight `Deref`-shadowed
+  accessors (`QuillValue: Deref<Target = serde_json::Value>` resolves each call
+  unchanged — no action). `prescan`'s helpers and `reader::err` drop to
+  `pub(crate)` (#1066, #1064). See `docs/migrations/0.97-to-0.98.md`
+- fix(python)!: rendered regions cross the boundary as `DocPath`. Python
+  returned plate-space addresses no document API accepts; the plate→`DocPath`
+  translation now lives in core as `regions_to_doc_path` and both bindings call
+  it, so `RenderResult.regions[].field` reads `main.body` /
+  `cards.<kind>[<i>].<field>` as WASM already did (#1063). See
+  `docs/migrations/0.97-to-0.98.md`
+- fix(content): three codec holes close. A mark spanning an island slot no
+  longer swallows it; a `LineKind` that disagrees with its segment is caught
+  (`Invariant::LineKindMismatch`, carrying a `LineKindMismatch` reason); and
+  decode is bounded — `MAX_NESTING_DEPTH` is enforced at the door, and a wire
+  position is read checked rather than `as usize`, which on wasm32 landed
+  `2^32 + 5` at position `5` (#1051)
+- fix(content): export's verify-and-drop safety net is bounded per line rather
+  than per mark; `CONVERT.md` states the import↔export coupling the net implies
+  (#1052)
+- fix(content): markdown import keeps a literal `*` that abuts strong or
+  emphasis — `a***a**` imports as `a`, `*`, strong `a`, where the deleted fixup
+  dropped the typed star. Removing it also fixes a backslash escape or entity in
+  such a span re-entering the content as literal source bytes (#1053)
+- feat(core): `FileTreeNode`, `QuillIgnore`, `QuillConfig`, the schema types,
+  and `ValidationError` are nameable from `quillmark` and from `quillmark_core`'s
+  root, so in-memory quill construction and schema reading need no direct core
+  dependency (#1055)
+- refactor(core,pdfform): `From<PdfError> for RenderError` replaces two
+  byte-identical `map_pdf_err` copies; `lopdf`, `js-sys` and `wasm-bindgen`
+  hoist into `[workspace.dependencies]`, the no-op `default-features = false`
+  pins drop, and `publish` is explicit on every crate (#1070, #1064)
+- docs(core): the card-kind validation line is documented where it lives —
+  construction (`Document::make_card`, `TryFrom<CardWire>`) is permissive
+  data-shaping and insertion is the gate, returning `edit::invalid_kind_name`
+- docs(canon): `ERROR.md` stops documenting a `fmt_pretty_with_source()` that
+  does not exist and states what carries the source chain: serialization to
+  both bindings, no Rust formatter. `error.rs`'s divergent path-grammar copy
+  gives way to a pointer at `path.rs` and the canon anchor table (#1061, #1069)
+- docs(canon): prune — canon stops re-documenting what `docs/` owns and states
+  each fact once; the lint checks truth rather than shape, and the CI job table
+  lists every job
+- test: test clusters go table-driven, wrong-altitude binding tests move down to
+  core, tests that pin foreign behavior or assert nothing are dropped, and one
+  walker and one quill builder replace the per-suite copies (#1060, #1056,
+  #1065, #1062, #1067)
+- ci: the zero-backend configuration is built and tested — `--workspace
+  --all-features` forces `typst` on, so that branch never compiled (#1068)
+
+
 ## v0.97.0 - 2026-07-24
 
 - core: one take_item primitive behind the three payload removers

package/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2025 Nibs
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.