quario 0.11.0 → 0.11.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # quario
 
+## 0.11.1
+
+### Patch Changes
+
+- **The declarations now carry `href` and `schemes`.** `StyleDeclarations` states `href`, `RunStyleDeclarations` picks it up as the twelfth inline name, and `QuarioOptions` states the `schemes` allowlist beside the three names that present `format`. The engine has admitted both since 0.11.0 and `SCHEMA.md` specifies them; the published types said otherwise, so a TypeScript consumer writing a link, or the allowlist that admits one, was told it was an error. The `format` declaration's own comment said a kind carries one modifier, which stopped being true when a number kind took three. `test/types.check.ts` exercises the allowlist and both spellings of a link, since a hand-written surface drifts exactly where nothing reads it.
+
 ## 0.11.0
 
 ### Minor Changes

package/lib/index.d.ts

@@ -95,8 +95,9 @@ export interface StyleDeclarations extends BoxDeclarations {
   valign?: ExpressionValue<VAlign>;
   /**
    * How a number or date is presented: a kind, or an object naming one and
-   * carrying the single modifier that kind understands — `digits` for the
-   * three number kinds, `form` for `date`. Locale stays on the instance.
+   * carrying the modifiers that kind understands — `digits`, `negative` and
+   * `zero` for the three number kinds, `form` for `date`. Locale stays on the
+   * instance.
    */
   format?: ExpressionValue<FormatDeclaration>;
   /**
@@ -107,6 +108,14 @@ export interface StyleDeclarations extends BoxDeclarations {
    * than falling back to the instance's currency. Unread without the kind.
    */
   currency?: ExpressionValue<string>;
+  /**
+   * Where this cell's text points: a URL, or `#` and a group's `label` for a
+   * destination inside the document. The one declaration the engine judges
+   * rather than passes on — a URL is admitted against the instance's `schemes`
+   * allowlist before it crosses, and a refused value is omitted, so the text
+   * renders and the link does not. A table row refuses it.
+   */
+  href?: ExpressionValue<string>;
   /** Blank space before this item, in points. */
   spaceBefore?: ExpressionValue<number>;
   /** Blank space after this item, in points. */
@@ -167,6 +176,7 @@ export type RunStyleDeclarations = Pick<
   | "uppercase"
   | "format"
   | "currency"
+  | "href"
 >;
 
 /**
@@ -516,6 +526,14 @@ export interface QuarioOptions {
   currency?: string;
   /** Timezone for `format: "date"`. Defaults to `"UTC"`. */
   timeZone?: string;
+  /**
+   * The URL schemes an `href` may use, each lower-case and ending in a colon.
+   * Defaults to `https:` and `mailto:`. The allowlist is the host's, never the
+   * document's, and a value this cannot read throws at construction rather
+   * than falling back — an allowlist quietly replaced is a host believing it
+   * restricted something it had not.
+   */
+  schemes?: readonly string[];
 }
 
 /** The settled result of an instance's license key verification. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quario",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Tiny, CSP-safe report engine for JavaScript. One JSON document renders to HTML, PDF, XLSX, CSV and Word.",
   "keywords": [
     "csp",