@wenathlan/saddle 1.8.12 → 1.8.13

package/dist/scrape/schema.d.ts

@@ -2,4 +2,22 @@
  * schema extraction accepts safe field descriptors and never evaluates source strings.
  */
 export declare function extractwithschema(html: any, schema: {}, url: any): {};
+/** Extracts schema fields with bounded payload and field-level source provenance. */
+export declare function extractstructured(html: any, schema?: {}, options?: {}): {
+    version: number;
+    sourceurl: string;
+    extractedat: string;
+    values: {};
+    provenance: {
+        [k: string]: {
+            sourceurl: string;
+            selector: string;
+            extractedat: string;
+            truncated: boolean;
+        };
+    };
+    bytes: number;
+    maxbytes: number;
+    truncated: any[];
+};
 //# sourceMappingURL=schema.d.ts.map

package/dist/scrape/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../scrape/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,KAAA,EAAE,MAAM,IAAK,EAAE,GAAG,KAAA,MAIvD"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../scrape/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,KAAA,EAAE,MAAM,IAAK,EAAE,GAAG,KAAA,MAIvD;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,IAAI,KAAA,EAAE,MAAM,KAAK,EAAE,OAAO,KAAK;;;;;;;;;;;;;;;;EAkBhE"}

package/dist/scrape/schema.js

@@ -7,6 +7,30 @@ export function extractwithschema(html, schema = {}, url) {
         result[name] = extractfield(html, descriptor, url);
     return result;
 }
+/** Extracts schema fields with bounded payload and field-level source provenance. */
+export function extractstructured(html, schema = {}, options = {}) {
+    if (typeof html !== "string")
+        throw new TypeError("structured extraction requires html text");
+    if (!schema || typeof schema !== "object" || Array.isArray(schema))
+        throw new TypeError("structured extraction requires a schema object");
+    if (options.parser !== undefined && typeof options.parser !== "function")
+        throw new TypeError("structured extraction parser must be a function");
+    const sourceurl = String(options.url ?? "");
+    const extractedat = String(options.extractedat ?? new Date(Number(options.now ?? Date.now())).toISOString());
+    const maxbytes = normalizebound(options.maxbytes ?? 65536, "maxbytes");
+    const parser = options.parser ?? ((input) => extractwithschema(input.html, input.schema, input.url));
+    const values = parser({ html, schema, url: sourceurl });
+    if (!values || typeof values !== "object" || Array.isArray(values))
+        throw new TypeError("structured extraction parser must return an object");
+    const bounded = boundpayload(values, maxbytes);
+    const provenance = Object.fromEntries(Object.entries(schema).map(([name, descriptor]) => [name, {
+            sourceurl,
+            selector: descriptorselector(descriptor),
+            extractedat,
+            truncated: bounded.truncated.includes(name)
+        }]));
+    return { version: 1, sourceurl, extractedat, values: bounded.values, provenance, bytes: bounded.bytes, maxbytes, truncated: bounded.truncated };
+}
 function extractfield(html, descriptor, url) {
     if (typeof descriptor === "function")
         return descriptor({ html, url });
@@ -22,4 +46,47 @@ function extractfield(html, descriptor, url) {
     return pattern.exec(html)?.[1]?.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim() ?? null;
 }
 function textfromselector(html, selector) { return extractfield(html, { selector }); }
+function descriptorselector(descriptor) { return typeof descriptor === "string" ? descriptor : typeof descriptor === "function" ? "function" : String(descriptor?.selector ?? "unknown"); }
+function normalizebound(value, name) { const normalized = Number(value); if (!Number.isSafeInteger(normalized) || normalized <= 0)
+    throw new RangeError(`${name} must be a positive safe integer`); return normalized; }
+function boundpayload(values, maxbytes) {
+    const bounded = {};
+    const truncated = [];
+    for (const [name, value] of Object.entries(values)) {
+        const candidate = JSON.stringify({ ...bounded, [name]: value });
+        if (byteLength(candidate) <= maxbytes) {
+            bounded[name] = value;
+            continue;
+        }
+        if (typeof value === "string") {
+            const clipped = clipstring(value, (trial) => byteLength(JSON.stringify({ ...bounded, [name]: trial })) <= maxbytes);
+            bounded[name] = clipped;
+        }
+        else {
+            bounded[name] = null;
+        }
+        truncated.push(name);
+    }
+    const bytes = byteLength(JSON.stringify(bounded));
+    if (bytes > maxbytes)
+        throw new RangeError("structured extraction payload budget is too small");
+    return { values: bounded, bytes, truncated };
+}
+function clipstring(value, fits) {
+    let low = 0;
+    let high = value.length;
+    let result = "";
+    while (low <= high) {
+        const middle = Math.floor((low + high) / 2);
+        const candidate = value.slice(0, middle);
+        if (fits(candidate)) {
+            result = candidate;
+            low = middle + 1;
+        }
+        else
+            high = middle - 1;
+    }
+    return result;
+}
+function byteLength(value) { return new TextEncoder().encode(String(value)).byteLength; }
 //# sourceMappingURL=schema.js.map

package/dist/scrape/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../scrape/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG;IACtD,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG;IACzC,IAAI,OAAO,UAAU,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IAC9H,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAChH,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,OAAO,QAAQ,SAAS,yBAAyB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,OAAO,yBAAyB,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1K,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAC/F,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../scrape/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG;IACtD,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE;IAC/D,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAC9F,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAC1I,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACjJ,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7G,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,UAAU,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC9I,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;YAC9F,SAAS;YACT,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC;YACxC,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC5C,CAAC,CAAC,CAAC,CAAC;IACL,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;AAClJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG;IACzC,IAAI,OAAO,UAAU,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IAC9H,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAChH,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,OAAO,QAAQ,SAAS,yBAAyB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,OAAO,yBAAyB,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1K,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAC/F,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAEtF,SAAS,kBAAkB,CAAC,UAAU,IAAI,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;AAE3L,SAAS,cAAc,CAAC,KAAK,EAAE,IAAI,IAAI,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC;IAAE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;AAExN,SAAS,YAAY,CAAC,MAAM,EAAE,QAAQ;IACpC,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;YACpH,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,GAAG,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,mDAAmD,CAAC,CAAC;IAChG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,KAAK,EAAE,IAAI;IAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;IACxB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,SAAS,CAAC;YAAC,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC;QAAC,CAAC;;YAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAK,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC"}

package/docs/artifactavailability.md

@@ -98,3 +98,19 @@ Version 1.8.12 is prepared to publish the expanded matrix below. The release wor
 | Browser extension | Manifest V3 | `saddle.extension.1.8.12.zip` |
 
 Each surface also emits `sha256.*.1.8.12`, `manifest.*.1.8.12.json` and, where enabled by the release path, SBOM and provenance metadata. The manifest must state `unsigned`, `ci-test-key`, `caller-owned`, `notarized` or the verified provider status actually produced by CI.
+
+## 1.8.13 release matrix
+
+Version 1.8.13 keeps the release-tag-derived matrix and adds deterministic retention metadata to generated artifact manifests. The implementation records retention policy and keep/prune decisions but never removes caller-owned files. Final URLs, checksums, sizes and signing states remain pending until the corresponding release workflow completes.
+
+| Surface | Architectures | Artifact naming contract |
+| --- | --- | --- |
+| Linux desktop browser | x64, arm64 | `saddle.browser.1.8.13.<architecture>.deb`, `.rpm`, `.appimage` |
+| Windows desktop browser | x86, x64, arm64 | `saddle.browser.1.8.13.<architecture>.exe`, `.msi` |
+| macOS desktop browser | x64, arm64 | `saddle.browser.1.8.13.<architecture>.dmg`, `.app.zip` |
+| Android | caller-configured signing | `saddle.apk.1.8.13.apk`, `saddle.aab.1.8.13.aab` |
+| iOS | caller-configured signing and provisioning | `saddle.ipa.1.8.13.ipa`, `saddle.app.1.8.13.app.zip` |
+| Container | OCI | `saddle.container.1.8.13.tar.gz` |
+| Browser extension | Manifest V3 | `saddle.extension.1.8.13.zip` |
+
+Each surface also emits `sha256.*.1.8.13`, `manifest.*.1.8.13.json` and, where enabled by the release path, SBOM and provenance metadata. The manifest may additionally carry `retention`, `retentionplan` and `retentionevaluatedat`; these fields are advisory execution decisions and do not imply deletion or publication.

package/docs/releasenotes-1.8.12.md

@@ -0,0 +1,46 @@
+# Saddle 1.8.12
+
+Saddle 1.8.12 consolidates the root-first native surfaces, the GPL-3.0-only project policy, release provenance and the cross-platform artifact contract. The package manifest and active native manifests remain at `1.8.12`. The uploaded scope README is not an execution script and was not rewritten.
+
+## Highlights
+
+| Area | Change |
+|---|---|
+| Licensing | Canonical GPL-3.0-only license, aligned package metadata and consolidated root legal documents. |
+| Release verification | Independent checksum, manifest and explicit signing-state verification. |
+| Storage | Paginated S3-compatible listing with prefix, continuation token, XML entity decoding and caller-owned limits. |
+| Scraping | Bounded recursive sitemap traversal with deduplication, cycle protection and injected fetcher. |
+| Browser | Bounded action recorder with immutable manifests, JSON export and explicit clearing. |
+| Workflows | Strict typed inputs, defaults, choices and deterministic trigger identities. |
+| Modes | Cross-runtime capability report with caller-owned host, port, credentials and provider boundaries. |
+| Security | Existing CodeQL, OSV, npm audit, cargo audit, Trivy, SBOM and provenance gates remain active. |
+
+## Artifact matrix
+
+The release workflows derive the version from the release tag and use these lowercase dotted names. This table is the contract expected from CI; it does not claim that an asset exists until the corresponding workflow attaches it.
+
+| Surface | Architectures or mode | Expected artifact |
+|---|---|---|
+| Linux desktop browser | x64, arm64 | `saddle.browser.1.8.12.<architecture>.deb`, `.rpm`, `.appimage` |
+| Windows desktop browser | x86, x64, arm64 | `saddle.browser.1.8.12.<architecture>.exe`, `.msi` |
+| macOS desktop browser | x64, arm64 | `saddle.browser.1.8.12.<architecture>.dmg`, `.app.zip` |
+| Android | caller-configured signing | `saddle.apk.1.8.12.apk`, `saddle.aab.1.8.12.aab` |
+| iOS | caller-configured signing and provisioning | `saddle.ipa.1.8.12.ipa`, `saddle.app.1.8.12.app.zip` |
+| Container | OCI | `saddle.container.1.8.12.tar.gz` |
+| Browser extension | Manifest V3 | `saddle.extension.1.8.12.zip` |
+
+Each generated surface must carry its checksum and manifest companion. Where enabled, CI also emits SBOM and provenance metadata. The signing state must be one of `unsigned`, `ci-test-key`, `caller-owned`, `notarized` or the exact provider status produced by CI. No unsigned artifact is described as trusted or production-signed.
+
+## Compatibility and upgrade notes
+
+The public package remains `@wenathlan/saddle`. The release does not downgrade the package to `1.8.3`; the active version is `1.8.12`. Version `1.8.21` is reserved for the next objective-driven research and implementation cycle. SignPath Foundation approval and production code-signing credentials remain caller-owned and are not implied by this release note.
+
+## Verification
+
+The prepared state passed 107 active tests, 69 legacy tests, engine build and syntax checks, formatting checks, web TypeScript and Pages build checks, npm pack dry-run, npm audit, flat-native validation and diff hygiene. Final artifact sizes and live download URLs must be filled from the actual GitHub Actions release run rather than estimated in advance.
+
+## References
+
+[1]: https://github.com/wenathlan/saddle "Saddle source repository"
+[2]: https://github.com/wenathlan/saddle/releases "Saddle release archive"
+[3]: https://github.com/wenathlan/saddle/blob/main/LICENSE "Saddle GPL-3.0-only license"

package/docs/releasenotes-1.8.13.md

@@ -0,0 +1,42 @@
+# Saddle 1.8.13
+
+Saddle 1.8.13 carries the active code and release-facing manifests forward from 1.8.12. The previous [1.8.12 release notes](releasenotes-1.8.12.md) remain the canonical record for the licensing and artifact baseline. The comparative 1.8.21 research is planning material and is not presented as a shipped feature.
+
+## Changes
+
+| Area | Change |
+|---|---|
+| Persistent queue | Added caller-owned leases, visibility timeout, deterministic clock injection, renewals, attempt accounting and idempotency-key deduplication. Existing crash recovery and retry behavior remain compatible. |
+| Version identity | Aligned npm, lockfile, Maven, NuGet, RubyGems, browser extension, Tauri, iOS, crawler and Capacitor metadata to `1.8.13`. The iOS marketing version is `1.8.13` with build `1008013`. |
+| Structured extraction | Added a schema-neutral result with field-level source URL, selector, extraction timestamp, bounded UTF-8 payload and caller-injected parser support. |
+| Browser context | Added allowlisted snapshot projection with stable snapshot and element references, deterministic UTF-8 byte budgets and truncation metadata. |
+| Workflow lifecycle | Extended resumable runs with explicit cancellation reasons and caller-owned, idempotent compensation callbacks. Compensation failures are surfaced as `COMPENSATION_FAILED`. |
+| Artifact retention | Added deterministic keep/prune decisions by maximum age, count or bytes. Manifest generation records policy and decisions and never deletes caller files. |
+| Documentation | Added the 1.8.13 release notes and retained the 1.8.12 artifact and signing policy documents. |
+| Architecture | Kept the root-first layout, no project-owned `src` directory, transport-neutral exports and caller-owned infrastructure. |
+
+## Artifact contract
+
+The active workflows derive names from the release tag. The following names are expected for a 1.8.13 run; actual URLs, checksums and sizes must come from the completed CI run.
+
+| Surface | Expected artifact family |
+|---|---|
+| Linux desktop | `saddle.browser.1.8.13.<architecture>.deb`, `.rpm`, `.appimage` |
+| Windows desktop | `saddle.browser.1.8.13.<architecture>.exe`, `.msi` |
+| macOS desktop | `saddle.browser.1.8.13.<architecture>.dmg`, `.app.zip` |
+| Android | `saddle.apk.1.8.13.apk`, `saddle.aab.1.8.13.aab` |
+| iOS | `saddle.ipa.1.8.13.ipa`, `saddle.app.1.8.13.app.zip` |
+| Container | `saddle.container.1.8.13.tar.gz` |
+| Browser extension | `saddle.extension.1.8.13.zip` |
+
+Signing remains explicit. `unsigned`, `ci-test-key`, `caller-owned`, `notarized` and a provider-reported status are distinct states. This release note does not claim SignPath approval or production signing.
+
+## Verification
+
+The queue, structured extraction, browser context, workflow compensation and retention features passed the active engine and release test suites. The complete release gate must be rerun after the implementation commit before a tag or release is created. The 1.8.21 research set remains the planning label for this feature batch and is not presented as a separate published version.
+
+## References
+
+[1]: https://github.com/wenathlan/saddle "Saddle source repository"
+[2]: https://github.com/wenathlan/saddle/releases "Saddle release archive"
+[3]: https://github.com/wenathlan/saddle/blob/main/docs/releasenotes-1.8.12.md "Saddle 1.8.12 release notes"