@vanduo-oss/vd3-cbun 1.1.0 → 1.3.0

package/CHANGELOG.md

@@ -4,6 +4,84 @@ All notable changes to `@vanduo-oss/vd3-cbun` are documented here. This file
 tracks the PACKAGE only — never docs-site content. Per-component VERSION
 constants are listed alongside each bundle release.
 
+## 1.3.0 — 2026-07-24
+
+Minor release. **New — chart mark clicks:** `VdChart` (and the typed
+`VdBarChart` / `VdLineChart` / … wrappers) now forward the core's mark-click
+callbacks as an idiomatic Vue emit family — `bar-click`, `point-click`, and
+`slice-click`, each carrying the core `ClickEvent` (`{ event, datum, index }`).
+The wrapper previously dropped the core's `onBarClick` / `onPointClick` /
+`onSliceClick` options, so a `<VdChart>` consumer could not receive a mark click
+at all even though the core's click wiring was already in place. Additive and
+backward-compatible; the `VdChartEmits` type is exported from `./charts`. Takes
+`VD_CHARTS_VERSION` `1.0.1 → 1.1.0`.
+
+**Hardening — bounded deserialization (draw + flowchart):** `normalizeDocument()`
+now caps an untrusted / corrupt document, **truncating (never throwing)** beyond
+conservative limits so a shared or hostile document cannot freeze the tab by
+being coerced O(n) and rendered — draw caps `MAX_SHAPES` (10 000) and
+`MAX_POINTS_PER_SHAPE` (100 000); flowchart caps `MAX_NODES` / `MAX_EDGES`
+(10 000 each). The `toJSON()` output is unchanged for in-range documents, so
+`VD_DRAW_VERSION` stays `1.1.0` and `VD_FLOWCHART_VERSION` stays `1.2.0` (both
+load-bearing — serialized into saved documents).
+
+**Core bug fixes** (framework-agnostic, no API or serialization change).
+**draw** — the undo history now coalesces only at the top of the stack, so a
+coalescing edit (nudge / style / text) made right after an undo no longer
+overwrites an earlier snapshot and corrupts the redo branch (mirrors the
+flowchart core's guard). **charts** — `renderBarChart` / `renderMultiBarChart`
+clamp the bar baseline into the rendered y-domain, so an explicit `yMin > 0` no
+longer draws bars past the axis floor (matches the area/line clamp).
+**music-player** — a repeat-off playlist now stops and dispatches
+`musicplayer:ended` at the final track instead of wrapping with a modulo and
+looping forever; the wrap stays exclusive to `repeat: 'all'`. **hex-grid** —
+`destroy()` now removes every canvas listener `_setupEvents` attaches (stored
+named handlers), fixing a leak on caller-supplied, reused canvases.
+**code-editor** — the CSS/JavaScript tokenizer now classifies an unterminated
+`/*` block comment to end-of-input as a `comment` instead of `plain`. Minor:
+bundle `1.2.0 → 1.3.0`.
+
+Also non-runtime: hex-grid + music-player `vue.d.ts` now type their emit events,
+the draw type surface declares its constants in `shapes.d.ts` (matching runtime),
+and added coverage for the code-editor keymap/`destroy()`, the music-player
+recreate teardown, tokenizer edge classification, and draw `clearHistory()`.
+
+Component versions in this release: **charts 1.1.0, code-editor 1.0.1, draw
+1.1.0, flowchart 1.2.0, hex-grid 1.0.1, music-player 1.0.1** — `charts` takes a
+minor bump `1.0.1 → 1.1.0` for the mark-click emits; code-editor, hex-grid, and
+music-player carry their `1.0.1` core-fix patch; `draw` stays `1.1.0` and
+`flowchart` continues its old-line `1.2.0` lineage (the deserialization caps
+change neither `toJSON()` format).
+
+## 1.2.0 — 2026-07-22
+
+Adds a sixth component, **`draw`** (`@vanduo-oss/vd3-cbun/draw` + `./draw/css`),
+exposing `VdDraw` — a first-party **vector drawing tool** (SVG world group with
+matrix pan/zoom, the flowchart architecture family) built around a
+dependency-free **brush engine**: freehand strokes are variable-width, smoothed,
+pressure/velocity-driven filled outline paths. It ships **brush presets** (`pen`,
+`pencil`, `marker`, `highlighter`, `calligraphy` — `BRUSH_PRESETS`), a **color
+palette** (swatches + custom color, opacity, brush size, recent colors), a
+**stroke eraser**, and secondary diagram shapes (rectangle / ellipse / arrow /
+text / sticky) with z-order, grouping, copy/paste/duplicate, snapping guides,
+keyboard shortcuts, and PNG + SVG export. The built-in toolbar uses inline
+Phosphor icons. Undo/redo funnels through a single `emitChange → recordHistory`
+whole-document choke point (pan/zoom not recorded); `toJSON()` / `load()`
+serialize `{ version, viewport, shapes }` — freehand strokes carry `brush` /
+`color` / `opacity` / per-point `pressure` — through a `normalizeDocument()`
+migration gateway (a v1 constant-width freehand loads as the default pen brush).
+Chrome theming is CSS-only through a `--vd-draw-*` → `--vd-*` layer; marks carry
+an explicit picked color. No new runtime dependency — `vue` stays the only peer,
+and every input bundled for the entry lives under `src/draw/` (the metafile
+isolation guard passes). The five existing components are untouched (tree-shake
+contract). Additive minor: bundle `1.1.0 → 1.2.0`.
+
+Component versions in this release: **charts 1.0.0, code-editor 1.0.0, draw
+1.1.0, flowchart 1.2.0, hex-grid 1.0.0, music-player 1.0.0** — `draw` entered the
+`component-versions.json` manifest at `1.0.0`, and its serialization (freehand
+`brush` / `color` / `pressure`) takes `VD_DRAW_VERSION` to `1.1.0`; the bundle's own semver
+stays decoupled from the per-component `VERSION` constants.
+
 ## 1.1.0 — 2026-07-21
 
 Adds a fifth component, **`code-editor`** (`@vanduo-oss/vd3-cbun/code-editor` +

package/README.md

@@ -3,15 +3,17 @@
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
 
 The Vanduo **components bundle** for the vd3 line: Vue3-only charts, code-editor,
-flowchart, hex-grid, and music-player consolidated into ONE package with
+draw, flowchart, hex-grid, and music-player consolidated into ONE package with
 tree-shakeable subpath exports. It replaces the four per-repo publishes
 (`@vanduo-oss/charts`, `@vanduo-oss/flowchart`, `@vanduo-oss/hex-grid`,
 `@vanduo-oss/music-player`) of the old line.
 
-**Status: 1.1.0.** Five Vue3-only component families — charts, code-editor,
+**Status: 1.2.1.** Six Vue3-only component families — charts, code-editor, draw,
 flowchart, hex-grid, music-player — each on its own tree-shakeable subpath, with
-the esbuild metafile isolation guard in place. (1.1.0 adds the first-party
-`code-editor` component; see the [changelog](./CHANGELOG.md).)
+the esbuild metafile isolation guard in place. (1.2.0 adds the first-party
+`draw` vector drawing tool — a brush engine + color palette; 1.2.1 patches four
+core bug fixes across charts / draw / hex-grid / music-player; see the
+[changelog](./CHANGELOG.md).)
 
 ## Install
 
@@ -35,6 +37,9 @@ import '@vanduo-oss/vd3-cbun/charts/css';
 import { VdCodeEditor } from '@vanduo-oss/vd3-cbun/code-editor';
 import '@vanduo-oss/vd3-cbun/code-editor/css';
 
+import { VdDraw } from '@vanduo-oss/vd3-cbun/draw';
+import '@vanduo-oss/vd3-cbun/draw/css';
+
 import { VdFlowchart } from '@vanduo-oss/vd3-cbun/flowchart';
 import '@vanduo-oss/vd3-cbun/flowchart/css';
 
@@ -53,8 +58,8 @@ import { VD3_CBUN_VERSIONS } from '@vanduo-oss/vd3-cbun';
 
 Each subpath entry (`dist/<component>/index.js`) re-exports **both** the Vue
 component and its framework-agnostic core (the core aliased with a `Core`
-suffix where the names collide — `VdCodeEditorCore`, `VdFlowchartCore`,
-`VdHexGridCore`). Isolation
+suffix where the names collide — `VdCodeEditorCore`, `VdDrawCore`,
+`VdFlowchartCore`, `VdHexGridCore`). Isolation
 is not a convention but a build guard: `scripts/build.js` bundles every entry
 separately with `vue` external, emits an esbuild metafile (`dist/meta.json`),
 and **fails the build** if any component entry's inputs reach outside its own
@@ -65,8 +70,8 @@ to confirm tree-shaking downstream.
 
 Notes:
 
-- `vue >=3.3.0` is a **required** peer dependency (the only runtime dep; never
-  bundled — it stays external in both the esm and cjs outputs).
+- The `vue` peer (see [Install](#install)) is never bundled — it stays external
+  in both the esm and cjs outputs.
 - Named exports only — no default exports on any subpath.
 - No IIFE builds and no `./vue` subpaths — the Vue bindings ARE the subpath
   exports; framework-agnostic cores stay exported alongside them.
@@ -78,16 +83,16 @@ Notes:
 The bundle's own semver (`package.json` version) is decoupled from the
 components inside it. Each component carries a VERSION constant tracked in
 `component-versions.json` at the repo root and asserted in tests against the
-exported `VD3_CBUN_VERSIONS` map. charts, code-editor, hex-grid, and
-music-player sit at `1.0.0`; **flowchart continues its old-line lineage at
-`1.2.0`** because `VD_FLOWCHART_VERSION` is load-bearing — it is serialized
-into user documents via `toJSON().version`. A new component enters the manifest
-at `1.0.0` (`code-editor` did, in bundle 1.1.0).
+exported `VD3_CBUN_VERSIONS` map. charts, code-editor, hex-grid, and music-player
+sit at `1.0.1`, draw at `1.1.0`; **flowchart continues its
+old-line lineage at `1.2.0`** because `VD_FLOWCHART_VERSION` is load-bearing —
+it is serialized into user documents via `toJSON().version`. A new component
+enters the manifest at `1.0.0` (`draw` did, in bundle 1.2.0).
 
 ## Theming
 
-All five components render against Vanduo's `--vd-*` design tokens — the same
-tokens `@vanduo-oss/vd3` defines. charts, code-editor, flowchart, and hex-grid
+All six components render against Vanduo's `--vd-*` design tokens — the same
+tokens `@vanduo-oss/vd3` defines. charts, code-editor, draw, flowchart, and hex-grid
 carry built-in fallbacks and degrade gracefully without them; **music-player
 expects the tokens**
 and renders with unset colors/backgrounds if none are provided. For correct
@@ -109,9 +114,10 @@ tokens works — but it is the canonical source.)
 
 ## Security
 
-- **One runtime dependency** — the `vue >=3.3.0` peer; nothing else is bundled
-  or required (`vue` stays external in every esm/cjs output, and the build fails
-  if any other module is externalized or any `node_modules` input is bundled).
+- **No bundled dependencies** — beyond the `vue` peer ([Install](#install)),
+  nothing is bundled or required; the build fails if any other module is
+  externalized or any `node_modules` input is bundled (the
+  [isolation guard](#subpath-import-model)).
 - **Hardened `.npmrc`:** `ignore-scripts`, `minimum-release-age`, `save-exact`,
   `strict-peer-dependencies`, `trust-policy=no-downgrade`,
   `block-exotic-subdeps`, and an explicit `registry`.
@@ -127,6 +133,8 @@ tokens works — but it is the canonical source.)
 | `@vanduo-oss/vd3-cbun/charts/css`         | Charts stylesheet (`dist/charts/vd3-charts.css`)             |
 | `@vanduo-oss/vd3-cbun/code-editor`        | `VdCodeEditor` + `VdCodeEditorCore`, `tokenize`, `highlight`, `LANGUAGES` |
 | `@vanduo-oss/vd3-cbun/code-editor/css`    | Code-editor stylesheet (`dist/code-editor/vd3-code-editor.css`) |
+| `@vanduo-oss/vd3-cbun/draw`               | `VdDraw` + `VdDrawCore`, `BRUSH_PRESETS`, `DRAW_TOOLS`, `VD_DRAW_VERSION` |
+| `@vanduo-oss/vd3-cbun/draw/css`           | Draw stylesheet (`dist/draw/vd3-draw.css`)                   |
 | `@vanduo-oss/vd3-cbun/flowchart`          | `VdFlowchart` + `VdFlowchartCore`, `computeLayout`, `FLOWCHART_*` |
 | `@vanduo-oss/vd3-cbun/flowchart/css`      | Flowchart stylesheet (`dist/flowchart/vd3-flowchart.css`)    |
 | `@vanduo-oss/vd3-cbun/hex-grid`           | `VdHexGrid` + `VdHexGridCore`, `VD_HEX_VERSION`              |

package/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: vanduo-vd3-cbun
-description: Use when adding Vanduo vd3 components with @vanduo-oss/vd3-cbun — the Vue 3 components bundle (charts, code-editor, flowchart, hex-grid, music-player) with tree-shakeable subpath exports. Covers install, per-subpath imports, CSS, theming, and per-component versioning.
+description: Use when adding Vanduo vd3 components with @vanduo-oss/vd3-cbun — the Vue 3 components bundle (charts, code-editor, draw, flowchart, hex-grid, music-player) with tree-shakeable subpath exports. Covers install, per-subpath imports, CSS, theming, and per-component versioning.
 ---
 
 # @vanduo-oss/vd3-cbun
 
-One bundle, five Vue 3 components, each on its own tree-shakeable subpath
-(`./charts`, `./code-editor`, `./flowchart`, `./hex-grid`, `./music-player`).
+One bundle, six Vue 3 components, each on its own tree-shakeable subpath
+(`./charts`, `./code-editor`, `./draw`, `./flowchart`, `./hex-grid`, `./music-player`).
 `vue >=3.3.0` is a required peer. The root import exposes only `VD3_CBUN_VERSIONS` — the per-
 component VERSION map. Every subpath re-exports the Vue wrapper AND the
 framework-agnostic core alongside it (the core aliased with a `Core` suffix
@@ -43,7 +43,7 @@ the scales (`scaleLinear`, `scaleTime`, `scaleBand`, `scalePoint`,
 `scaleOrdinal`), accessor/tick helpers (`createAccessor`, `ticks`,
 `niceDomain`), the path builders (`linePath`, `areaPath`, `arcPath`), and
 `resolveTheme`. No name collision, so the core factories keep their own names.
-CSS ships at `@vanduo-oss/vd3-cbun/charts/css`. `VD_CHARTS_VERSION` is `1.0.0`.
+CSS ships at `@vanduo-oss/vd3-cbun/charts/css`. `VD_CHARTS_VERSION` is `1.0.1`.
 
 ## Code-editor
 
@@ -68,6 +68,34 @@ Key props: `language`, `readOnly`, `lineNumbers`, `tabSize`, `wrap`,
 `blur`, `ready`. CSS ships at `@vanduo-oss/vd3-cbun/code-editor/css`.
 `VD_CODE_EDITOR_VERSION` is `1.0.0`.
 
+## Draw
+
+```js
+import { VdDraw, VdDrawCore } from '@vanduo-oss/vd3-cbun/draw';
+import '@vanduo-oss/vd3-cbun/draw/css';
+```
+
+`VdDraw` is the Vue 3 wrapper; the framework-agnostic editor core shares the
+class name, so it is re-exported as `VdDrawCore`. It is a first-party **vector
+drawing tool** (SVG world group with matrix pan/zoom) with a **brush engine** —
+freehand strokes are variable-width, smoothed, pressure/velocity-driven filled
+outline paths — and brush presets (`pen`, `pencil`, `marker`, `highlighter`,
+`calligraphy`, in `BRUSH_PRESETS`), a **color palette** (swatches + custom color,
+opacity, size, recent colors), a **stroke eraser**, plus secondary diagram
+shapes (rectangle / ellipse / arrow / text / sticky), z-order, grouping,
+copy/paste/duplicate, snapping guides, and PNG + SVG export. The built-in toolbar
+uses inline Phosphor icons. Undo/redo runs through a single `emitChange →
+recordHistory` choke point (whole-document snapshots; pan/zoom not recorded);
+`toJSON()` / `load()` serialize `{ version, viewport, shapes }` (freehand strokes
+carry `brush` / `color` / `opacity` / per-point `pressure`) via a
+`normalizeDocument()` migration gateway. Chrome theming is CSS-only via a
+`--vd-draw-*` → `--vd-*` layer; marks carry an explicit picked color. The subpath
+also re-exports `BRUSH_PRESETS`, `DRAW_TOOLS`, `DRAW_SHAPE_TYPES`, and
+`VD_DRAW_VERSION`. Key props: `data`, `tool`, `readonly`, `gridSize`, `snap`,
+`autoFit`, `history`, `historyLimit`; events: `change`, `select`, `viewport`,
+`ready`. CSS ships at `@vanduo-oss/vd3-cbun/draw/css`. `VD_DRAW_VERSION` is
+`1.1.0`.
+
 ## Flowchart
 
 ```js
@@ -108,7 +136,7 @@ subpath (coordinate transforms, rotation, distance, plus the terrain tables:
 and the `isPassable` / `getMovementCost` / `getTerrainYields` / `getTerrainColor`
 helpers). Hex-grid ships **no CSS** — it renders to a canvas and reads `--vd-*`
 theme tokens off the host element via `getComputedStyle`. `VD_HEX_VERSION` is
-`1.0.0`.
+`1.0.1`.
 
 ## Music-player
 
@@ -125,12 +153,12 @@ core (no name collision, so it keeps its own name) re-exported alongside
 `musicplayer:detach`, `musicplayer:attach`, `musicplayer:minimize`,
 `musicplayer:expand`); the wrapper re-emits each as a Vue event (`@play`,
 `@trackchange`, …, plus `@ready`) carrying `event.detail`. CSS ships at
-`@vanduo-oss/vd3-cbun/music-player/css`. `VD_MUSIC_PLAYER_VERSION` is `1.0.0`.
+`@vanduo-oss/vd3-cbun/music-player/css`. `VD_MUSIC_PLAYER_VERSION` is `1.0.1`.
 
 ## Theming
 
-All four components render against Vanduo's `--vd-*` design tokens — the same
-tokens `@vanduo-oss/vd3` defines. charts, flowchart, and hex-grid ship built-in
+All six components render against Vanduo's `--vd-*` design tokens — the same
+tokens `@vanduo-oss/vd3` defines. charts, code-editor, draw, flowchart, and hex-grid ship built-in
 fallbacks and degrade gracefully without them; **music-player expects the tokens**
 and renders with unset colors/backgrounds if none are present. Provide them on an
 ancestor element — simplest is to import the vd3 stylesheet (`@vanduo-oss/vd3/css`,

package/dist/charts/index.cjs

@@ -70,7 +70,7 @@ var DEFAULT_COLORS = [
   "#be4bdb",
   "#fd7e14"
 ];
-var VD_CHARTS_VERSION = "1.0.0";
+var VD_CHARTS_VERSION = "1.1.0";
 var chartId = 0;
 function nextId(prefix) {
   chartId += 1;
@@ -946,7 +946,7 @@ function renderBarChart(instance) {
   drawAnnotations(svg, options, plot, xScale, yScale, theme);
   const labels = dataLabelConfig(options);
   const markGroup = append(svg, svgEl("g", { class: "vd-chart-marks vd-chart-bars" }));
-  const baseline = yScale(0);
+  const baseline = yScale(Math.min(Math.max(0, yDomain[0]), yDomain[1]));
   rows.forEach((row) => {
     const x = xScale(row.x);
     const y = yScale(row.y);
@@ -1038,7 +1038,7 @@ function renderMultiBarChart(instance) {
   drawAnnotations(svg, options, plot, xScale, yScale, theme);
   const labels = dataLabelConfig(options);
   const markGroup = append(svg, svgEl("g", { class: "vd-chart-marks vd-chart-bars" }));
-  const baseline = yScale(0);
+  const baseline = yScale(Math.min(Math.max(0, yDomain[0]), yDomain[1]));
   seriesList.forEach((series) => {
     const fill = seriesColor(series, theme);
     series.rows.forEach((row) => {
@@ -1704,7 +1704,7 @@ var CHART_PROPS = {
   xAxis: { type: Object, default: void 0 },
   yAxis: { type: Object, default: void 0 }
 };
-function optionsFrom(target, props) {
+function optionsFrom(target, props, emit) {
   return {
     target,
     type: props.type,
@@ -1735,20 +1735,30 @@ function optionsFrom(target, props) {
     xFormat: props.xFormat,
     yFormat: props.yFormat,
     xAxis: props.xAxis,
-    yAxis: props.yAxis
+    yAxis: props.yAxis,
+    // Forward the core's mark-click callbacks as the Vue emit family. Passing
+    // all three unconditionally is safe: the core only fires the callback
+    // relevant to the rendered chart type (bars → onBarClick, points →
+    // onPointClick, slices → onSliceClick).
+    onBarClick: (e) => emit("bar-click", e),
+    onPointClick: (e) => emit("point-click", e),
+    onSliceClick: (e) => emit("slice-click", e)
   };
 }
 var VdChart = (0, import_vue.defineComponent)({
   name: "VdChart",
   props: CHART_PROPS,
-  setup(props) {
+  // Mark clicks the core reports through its callbacks are re-emitted here as
+  // idiomatic kebab-case Vue events carrying the core `ClickEvent` payload.
+  emits: ["point-click", "bar-click", "slice-click"],
+  setup(props, { emit }) {
     const el = (0, import_vue.ref)(null);
     let instance = null;
     let currentType = props.type;
     const create = () => {
       const factory = FACTORIES[props.type] || BarChart;
       currentType = props.type;
-      instance = factory(optionsFrom(el.value, props));
+      instance = factory(optionsFrom(el.value, props, emit));
     };
     (0, import_vue.onMounted)(() => {
       if (typeof window === "undefined" || !el.value) return;
@@ -1792,7 +1802,7 @@ var VdChart = (0, import_vue.defineComponent)({
           instance.destroy();
           create();
         } else {
-          instance.update(optionsFrom(el.value, props));
+          instance.update(optionsFrom(el.value, props, emit));
         }
       },
       { deep: true }