anymd 8.5.6

Patch Changes

• Accept the current production Money licence signer alongside the historical key. Explicit pro --test activation uses separate test trust and storage, keeping test grants out of ordinary CLI/MCP Pro operations.

• State each shared rule once. The pages selector, the two-decimal ratio, the UTF-16 length, the warning list and the token estimate and front-matter quoting that the CLI and the browser both use now live in anymd-core (pages, fusion_util, text_rules), and the provider concurrency slot and request budget that OCR and region analysis both enforce live in anymd (provider_budget, with pdf_evidence_common for the shared argument parsing, truncation and tool result). Messages, limits, accepted page specifications and outputs are unchanged. The WASM build links anymd-core for these rules.

• The browser build no longer links a socket: anymd-core's URL fetcher is behind its native feature (on by default), so the playground keeps its formats (a browser opens no URL), and a build without it refuses a url source with a message instead of failing to link.

• Remove the unused tool_routes module and the unused assert_host_not_private export from anymd-core.

• Dependency declarations now match their use: the package renames sylphx-mcp-kit (imported as mcp_kit), kamadak-exif (imported as exif), the vendored OCR crate's feature-only candle-transformers and the vendored PDF fork's not-yet-used postscript are declared to cargo machete, so the unused-dependency census reports no false edges.

Documentation

• Record how published advisories are kept: every published advisory gets a CVE ID from GitHub as CNA, and one vulnerability is published once (docs/security/advisories.md). GHSA-xrc8-gj3q-m8vm is the canonical record for the pdf_compare allowlist bypass; GHSA-f8xf-6vpc-6hpj is its duplicate and says so.
• Name the hosted, metered mode of the same crates: Sylphx AI parse serves the anymd-core, anymd-pdf and anymd-formats crates at a pinned published version for callers that want no local runtime, billed per page. The local anymd binary stays free and MIT and keeps every feature. Vision and the "Local and hosted" page now record this instead of saying a hosted service would be a separate product.
• Record the crate API policy: the public converter API of anymd-core, anymd-pdf and anymd-formats is semver-stable within a major version. A patch release fixes behaviour without changing the public API, a minor release adds API without breaking one, and a breaking change ships only in a major version — so the hosted service's pinned version keeps working and is moved forward deliberately.