@quillmark/wasm 0.98.0 → 0.100.0

package/CHANGELOG.md

@@ -1,5 +1,212 @@
 # Changelog
 
+## v0.100.0 - 2026-08-03
+
+A content field gets one resting form, and the last reserved `$` key with no
+reader is removed. All breaking changes are covered by
+`docs/migrations/0.99-to-0.100.md`. Stored documents load unchanged, but a row
+read through the bound door converges once: read-repair, not a schema-version
+event. One ordering matters, and the guide's "Legacy data" section states it —
+conform a stored population before exporting markdown from it.
+
+- refactor(core,wasm,python)!: content fields have one resting form, enforced at
+  load. `Quill::conform(&mut doc)` is the primitive and `Quill::parse(md)`
+  (parse, then conform) the convenience — the documented primary ingestion path,
+  `quill.parse` / `quill.conform` on both bindings. A `richtext` field rests as
+  the canonical content object, a `plaintext` field as its **literal string**, so
+  the stored shape is a property of the codec instead of the construction lane:
+  `equals` and content hashes stop separating semantically identical documents.
+  The typed writer commits `plaintext` as a string, and `revise_field` diffs it
+  through the literal codec (a byte-identical revise of `a \*b\*` used to commit
+  `a *b*`). `Document::parse` / `Document.fromMarkdown` stay exactly as they
+  were, demoted to the transport/repair door. Conform is idempotent, a byte no-op
+  on an already-canonical document, and reports a `conform::*` warning where the
+  strict write refuses rather than retyping or rejecting; a `$quill` naming
+  another quill errors before any mutation (#1160, #1162). See
+  `docs/migrations/0.99-to-0.100.md`
+- fix(core)!: markdown exported from a `plaintext` field resting as a content
+  object is markdown-escaped. Emit is schema-free and cannot tell a `plaintext`
+  content from a `richtext` one, so `a *literal* line` leaves as
+  `a \*literal\* line` and re-parses with the backslashes as characters — one
+  more layer per save cycle. Only the typed writer produced that rest, and the
+  string rest above deletes it rather than managing it: load, conform, and
+  re-store a population before exporting markdown from it. Markdown already
+  exported under ≤0.99 is corrupt at rest, its escapes indistinguishable from
+  authored ones, so re-export it from the conformed rows (#1159). See
+  `docs/migrations/0.99-to-0.100.md`
+- fix(core,wasm,python)!: a `plaintext` field resting as a string reads through
+  the **literal** codec, not markdown — `note: 'a *literal* line'` read back as
+  `a literal line` while render and validation kept the asterisks. Only the
+  string lane was wrong; the committed-object lane always decoded correctly, so
+  a consumer that pre-escaped a `plaintext` field to survive the read drops the
+  escaping. Alongside it, `reader.get_content` / `reader.getContent` returns a
+  content field's `Content` corpus whichever lane stored it, so a consumer
+  holding a corpus editor stops branching on the wire shape. `EditError` gains
+  `FieldNotContent` (`edit::field_not_content`) for a declared type that is not a
+  content leaf; core adds `Card::field_plaintext_content` (#1154). See
+  `docs/migrations/0.99-to-0.100.md`
+- refactor(core,wasm,python)!: card `$id` is removed — the reserved key, its
+  resolver (`Document::find_card` / `doc.cardIndexById` / `doc.card_index_by_id`),
+  the uniqueness contract (`EditError::CardIdCollision` / `EmptyCardId`, the
+  `parse::card_id_*` warnings, the storage rejection), `Card::id` /
+  `Payload::{id, set_id, take_id}` / `Document::{set_card_id, remove_card_id}`,
+  the `PayloadItem::Id` and `CardWire.id` wire members, and the projected `id` on
+  both bindings' card shape. Nothing in the engine read it and it never reached a
+  backend, so what is left after removing the machinery that served the resolver
+  is `$ext` with a reserved name. A block declaring `$id` no longer parses and a
+  blob carrying an `id` payload item no longer loads: a hard cutover, no
+  tolerate-and-ignore window. Per-card consumer keys move to `$ext` under a
+  namespace you own, with no uniqueness, no collision check, and no repair
+  (#1151). See `docs/migrations/0.99-to-0.100.md`
+- refactor(content)!: `Content`, `Line`, `Mark`, and `Island` take
+  `#[non_exhaustive]` — the four public structs the 0.99 sweep missed, that pass
+  having run as two issues split by crate. Their literals give way to `new` plus
+  the `with_*` setters on the same terms as the rest of the API; every field stays
+  `pub`, so reading and assigning are unchanged. `Delta`, `Segment`, and
+  `BaseLengthMismatch` stay open deliberately and now say so in their rustdoc.
+  A Rust source break only: nothing about the wire, the canonical bytes, or the
+  bindings moves (#1146). See `docs/migrations/0.99-to-0.100.md`
+- feat(core,wasm,python): `Diagnostic.args` — the facts `message` interpolates,
+  keyed by name, so a consumer with its own string table selects a sentence by
+  `code` and fills it itself. Values keep their JSON shape (a list arrives as a
+  list, a count as a number), engine prose never rides under a key, and a
+  formatter missing a key falls back to `message` wholesale. `prose/canon/ERROR.md`
+  § "Diagnostic args" tabulates the keys per code and a test fails when code and
+  canon disagree (#1130)
+- fix(core): the `$quill` mismatch message and hint name the pairing rather than
+  the verb. `check_quill_reference` gates every schema-bound door now, not the
+  render path alone, so a `quill.parse` failure no longer reads "was rendered
+  with". The codes (`quill::name_mismatch` / `quill::version_mismatch`) are
+  unchanged
+- test(fuzz): the resting-form invariant gains a target, stated as three
+  properties — conform is a fixed point, parse-then-conform equals typed-write
+  per content field, and a document through the markdown surface and back settles
+  after one pass (exactly, for `plaintext`, whose codec is lossless both ways)
+- docs: the cycle's stale pages are repaired. Both binding READMEs gain the bound
+  door and the corpus read, `revise_field` is documented per declared type on all
+  four surfaces instead of as a markdown-only richtext verb, and four canon claims
+  that outran the tree are corrected
+
+
+## v0.99.0 - 2026-08-01
+
+The 1.0.0 API freeze lands ahead of the tag, and the content codec closes its
+last open gaps. All breaking changes are covered by
+`docs/migrations/0.98-to-0.99.md`. Stored documents are unaffected: a `0.98` blob
+loads byte-identically and `0.99` writes the same bytes for the same content.
+
+- refactor(core,content,pdf,pdfform)!: the public API opens. 75 public types take
+  `#[non_exhaustive]` — nothing in the workspace carried it before — so an
+  exhaustive `match` needs a `_` arm and a struct literal gives way to `new` plus
+  `with_*` setters. `Backend` is sealed, `OutputFormat::ALL` and
+  `Content::RESERVED_{MARK_TYPES,LINE_KINDS,CONTAINERS}` become slices, and
+  `RenderOptions { .., ..Default::default() }` becomes
+  `RenderOptions::default().with_output_format(fmt)`. Four stay exhaustive and
+  say so: the storage DTOs, frozen per schema version, plus
+  `quillmark_pdf::FieldType`, `KnownIslandType`, and `Fidelity`, where an
+  out-of-crate `_` arm is silent (a field that draws nothing, an island dropped
+  from the projection, a fidelity rung nothing warns about). The rules are
+  canonized in `prose/canon/COMPATIBILITY.md` (#1090, #1103). See
+  `docs/migrations/0.98-to-0.99.md`
+- refactor(core)!: the YAML engine leaves the public API. `QuillValue::from_yaml_str`
+  and `QuillConfig::schema_yaml` return `quillmark_core::YamlError` instead of
+  `serde_saphyr` types, so a `0.0.x` dependency release is no longer a break to
+  `quillmark-core`. The message is sanitized (the engine's own Rust API names are
+  stripped), and `from_yaml_str` gains the `MAX_YAML_DEPTH` budget its siblings
+  already carried (#1099, #1101). See `docs/migrations/0.98-to-0.99.md`
+- fix(content)!: the reserved-name rule reaches the wire. `attrs` beside a
+  built-in discriminator resolved to the built-in and dropped the payload in
+  silence; the authored lane now refuses it on all four axes, where a host writes
+  it. Reading never got stricter — a blob from before a promotion still opens.
+  A table cell keeps its own unknown keys too, canonicalization now rewriting it
+  in place rather than minting a fresh `{text, marks}` (#1084, #1085, #1086,
+  #1092). See `docs/migrations/0.98-to-0.99.md`
+- fix(content)!: opaque payload depth is bounded at `MAX_JSON_DEPTH` (128) on the
+  `Value` lane, where an unbounded one took the WASM module down with a
+  stack-overflow trap rather than a catchable error. The WASM guard sits on the
+  JS side of the boundary, since `serde_wasm_bindgen` recurses while building the
+  value, and covers every door that takes opaque host JSON: `install` and
+  `applyChange`, plus `makeCard`'s field values and `insertCard`'s payload items
+  (#1093). See `docs/migrations/0.98-to-0.99.md`
+- fix(content)!: island `loss` becomes the fifth open set. An unrecognized class
+  round-trips verbatim instead of being rewritten to `unrepresentable`, so merely
+  opening a document no longer moves its content hash. `Loss` opens on the island
+  `type` axis' terms rather than the block axes': it becomes an opaque string
+  wrapper with `LOSSLESS` / `DEGRADED` / `UNREPRESENTABLE` consts, one value per
+  wire string, so a built-in's name has no second spelling and needs no
+  reserved-name rule. `Fidelity` is the closed view `Loss::fidelity` returns, and
+  is where a consumer switches; `Loss` consequently loses its `Copy` derive
+  (#1091, #1142). See `docs/migrations/0.98-to-0.99.md`
+- refactor(core,typst,pdf)!: workspace-internal seams leave the published
+  surface. `quillmark-pdf`'s `reader`/`writer` modules and `quillmark_typst::emit`
+  become `#[doc(hidden)]`; the op-wire encoders emit an unknown's `attrs` in
+  caller key order, the redundant per-encoder sort having been dropped (canonical
+  content bytes are unchanged, the terminal sort still running) (#1095). See
+  `docs/migrations/0.98-to-0.99.md`
+- fix(wasm)!: a `Quill` or `Document` from a second copy of `@quillmark/wasm` is
+  refused everywhere, as a `QuillmarkError` coded `runtime::foreign_handle` that
+  names the cause and hints `npm ls @quillmark/wasm`. 0.98 half-worked there:
+  `Engine` was duck-typed, so a quill from copy A rendered on an engine from copy
+  B at a per-copy clone cache nobody could see, while `Document.equals`,
+  `Quill.validate`, `Quill.resolve` and the typed writer met wasm-bindgen's bare
+  `expected instance of Document` at a value that *is* a `Document`. The check
+  covers `Engine` (`render`, `open`, `supportedFormats`, `supportsCanvas`),
+  `LiveSession.apply`, the writer and reader binds, and the three by-reference
+  core methods; a value that is not a handle at all keeps its own
+  `runtime::not_a_document` / `runtime::not_a_quill`. Nothing changes for a
+  one-copy install (#1132, #1136). See `docs/migrations/0.98-to-0.99.md`
+- feat(wasm): `isUnknownLine` / `isUnknownContainer` / `isUnknownMark` /
+  `isUnknownIsland` answer known-vs-unknown on each open set, so a consumer no
+  longer enumerates built-in names in its own source. `ContentLineKind` is
+  re-exported from the package entry point, so a `setKind` op type-checks without
+  a cast
+- feat(python): the Tier-1 gaps close. `doc.card(i)`, `doc.card_index_by_id(id)`,
+  and `doc.seed_overlay(kind)` are the single-card, `$id`, and seed reads WASM
+  already had, and the wheel ships `py.typed` plus stubs, so mypy and Pyright see
+  real signatures where the surface used to resolve to `Any` (#1011)
+- fix(typst): four quill-load defects — a skipped asset, an unparseable
+  `typst.toml`, a skipped package file, a declared-but-absent entrypoint —
+  become `RenderResult` warnings (`typst::path_skipped`,
+  `typst::package_manifest`, `typst::package_entrypoint_missing`) instead of
+  `eprintln!` that wasm32 has nowhere to print (#1102)
+- fix(wasm): the npm package states the license the workspace actually grants.
+  `package.json` declared `MIT OR Apache-2.0` where every Rust crate, the
+  workspace manifest, and the only `LICENSE` file in the tree are `Apache-2.0`,
+  and the package shipped no license text at all: `build-wasm.sh` copied
+  `LICENSE-MIT` and `LICENSE-APACHE`, neither of which exists. It now copies
+  `LICENSE`, or refuses to produce a package
+- ci: the release gates the tag actually needs. New `package` (builds every
+  publishable crate from its own archive and asserts each ships its `LICENSE`),
+  `msrv` (holds `rust-version` to something true), and `audit` (bare `cargo
+  audit` over the lockfile) jobs; the workspace moves to edition 2024 and
+  declares MSRV 1.92. The `semver` job is dropped — it compared the tree's
+  unbumped version against itself — and `COMPATIBILITY.md` names the writer and
+  reviewer as what holds the promise instead (#1105, #1106, #1107, #1108)
+- ci: the rustdoc gate covers the whole workspace. A bare `cargo doc` walks
+  default-members and never lints a crate outside it — the blind spot that let
+  the `Delta` links rot on the WASM surface and four more in the published
+  `quillmark-content`. `--workspace` needs no `--exclude` and covers the next
+  such crate on the day it lands
+- test(fuzz): the four JSON decode lanes the bindings expose gain coverage
+  (#1104)
+- docs(canon): `COMPATIBILITY.md` states the crate-API promise — what
+  `#[non_exhaustive]` does and does not buy, when to mark an enum, and what no
+  attribute sweep catches
+- docs(all): the em-dash leaves comments and prose, folded to a colon, comma,
+  semicolon, or parentheses across ~2900 sites. `dense-prose` banned it while
+  every exemplar it named used it; the corpus now matches the rule. A handful of
+  diagnostic and CLI message strings repunctuate with it (`edit::body_only`,
+  `validation::must_fill`, the pdfform bind errors, `--help`); codes, severities,
+  and paths are unchanged. The character stays where it is the subject rather
+  than punctuation: the WinAnsi encoding table, the YAML en/em-dash fixtures, and
+  `docs/migrations/` (#1135)
+- chore(core): `serde-saphyr` moves to `1.0`. The two call sites that built
+  `Options`/`SerializerOptions` with struct-literal-plus-`..Default::default()`
+  now go through the crate's own `options!`/`ser_options!`/`budget!` macros,
+  which the 1.0 release requires since both structs are `#[non_exhaustive]`.
+  `serde_saphyr` types stay out of `quillmark-core`'s public API (see the YAML
+  engine entry above), so nothing downstream moves
+
 ## v0.98.0 - 2026-07-28
 
 Five breaking changes, all covered by `docs/migrations/0.97-to-0.98.md`.
@@ -148,7 +355,7 @@ Stored documents are unaffected: a `0.97` blob loads byte-identically and
 - **breaking** core,wasm,python: a schema-bound read view — `Quill::view(&doc)` / `quill.view(doc)`, the read twin of `quill.writer(doc)`. `view.get(addr)` interprets each field by its declared type (a `richtext` field → markdown, a `plaintext` field → its literal text via the plaintext codec, every other type → its canonical value verbatim), returns absent as `undefined` / `None`, and — the authority the quill-free `getMarkdown` lacks — throws `UnknownField` for a name the schema does not declare and `FieldRichtextDecode` for a content field holding an undecodable value. Core `TypedReader::get` returns a `ReadValue` (`Markdown`/`Plaintext`/`Value`); `view.card(i)` is the card cursor; core adds `Card::field_plaintext` (the `to_plaintext` twin of `field_markdown`). **`getMarkdown`'s field half retires**: `getMarkdown` / `get_markdown` / `get_card_markdown` are now body-only (WASM `getMarkdown` takes a `CardAddr`, a present `field` throws; Python drops the `name` parameter) — a field's markdown is read through `view.get`. The quill-free body projection stays on `Document` (#978)
 - **breaking** content: one delta-application contract — implicit trailing retain is `try_apply`'s semantics (a short delta retains the untouched remainder; the error is over-consumption only), `apply` panics on an over-long delta instead of clamping (clamping is silent corruption), and `extend_to_base` is removed. `split_line` / `join_line` rebase marks through their one-char `\n` splice with `map_pos` — the same mapping the text-delta channel uses — so marks no longer drift across line ops and `apply_field_change` canonicalizes once (a single terminal normalize instead of one per stage); line sync rebuilds in one forward pass instead of per-`\n` `Vec` splices. Mark ops are specified in final-text coordinates (post-delta, post-line-op — the frame they validate against) (#926, #987)
 - **breaking** core: storage blobs tagged `@0.81.0` / `@0.82.0` fail as an unknown schema version — the read-only `V0_81_0` / `V0_82_0` DTO trees and their forward migrations are retired (nothing persisted on this lineage predates `@0.92.0`; `0.82.0` was yanked). `V0_92_0` stays the oldest shape read, and its payload types back the current write path. DOCUMENT_STORAGE.md records variant retirement as the policy when no stored population remains (#929)
-- **breaking** core,wasm,python: the markdown projection stops appending a trailing newline — `to_markdown` projects a *value*, not a file, so `field_markdown` / `body_markdown` (WASM `getMarkdown` / `exportMarkdown`, Python `export_markdown` / `get_markdown`) no longer grow a `\n`; `writer.set("subject", "Hello")` reads back as `"Hello"`, not `"Hello\n"`. `.qmd` files still end in one newline (owned by `Document::to_markdown`, the file writer) and the content fixed point is unchanged (import is newline-insensitive) (#965)
+- **breaking** core,wasm,python: the markdown projection stops appending a trailing newline — `to_markdown` projects a *value*, not a file, so `field_markdown` / `body_markdown` (WASM `getMarkdown` / `exportMarkdown`, Python `export_markdown` / `get_markdown`) no longer grow a `\n`; `writer.set("subject", "Hello")` reads back as `"Hello"`, not `"Hello\n"`. The content fixed point is unchanged (import is newline-insensitive) (#965)
 - **breaking** all: rename the content genus off its codec's name — crate `quillmark-richtext` → `quillmark-content`, type `RichText` → `Content` (and `RichTextLine`/`RichTextContainer`/`RichTextMark`/`RichTextIsland` → `ContentLine`/…), const `RICHTEXT_MEDIA_TYPE` → `CONTENT_MEDIA_TYPE` and its wire string `application/quillmark-richtext+json` → `application/quillmark-content+json`, `#[serde(skip)]` companion caches `FieldSchema::{default,example}_corpus` → `_content`, `SegmentMap.corpus: Range<usize>` → `.content`, Typst-emitter `EmittedContent` → `Emission` (it is markup + source map, not a Typst `content` value). Schema tokens `richtext` / `plaintext`, `FieldType::{RichText,PlainText}` variants, and the codec-specific `field_richtext` / `FieldRichtext*` / `apply_field_richtext_change` / `richtext(inline)` surface are unchanged — those name codecs, not the model. Canonical body JSON is nameless, so stored documents don't migrate; `contentMediaType` consumers pin to the new spelling. Retires the informal "corpus" noun to end the code/prose split (#976)
 - **breaking** core,wasm,python: `getMarkdown` / `get_markdown` / `get_card_markdown` stop conflating an absent field with a present-but-not-richtext one — a present field that does not decode as richtext (a scalar/array/object a `storeField` wrote) now throws `FieldRichtextDecode` instead of reading back `undefined` / `""`; absence still returns the absent shape. Core `Card::field_markdown` becomes `Option<Result<String, RichtextDecodeError>>` (the projection twin of `field_richtext`). Rule: absence returns, mismatch raises; read the raw value with `get` (#968)
 - feat(core,wasm): typed, anchor-preserving field revise — `TypedWriter::revise_field` / `CardWriter::revise_field` and `writer.reviseField` / `writer.card(i).reviseField` wrap core `Card::revise_field_checked` (diff-rebase surviving anchors, then schema-conform the result); the schema-bound verb lives on the writer, where the schema is (#957, #966)

package/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2025 Nibs
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.