v0.1.2

Improvements

• Hardened install-time supply-chain checks: CI and release jobs now install the workspace with npm ci --ignore-scripts and then run an explicit allowlist check for dependency install scripts.
• Resolved the active npm audit findings by moving the affected toolchain packages to patched versions and pinning Vite through an override.
• Updated GitHub Actions used by CI, docs, release, and resource benchmark workflows.
• Applied the safe Cargo dependency updates while keeping parley pinned until the Blitz integration can move without type conflicts.
• Repaired the release workflow so publish reruns skip package versions that already exist on npm and publish workspace packages directly.

Verification

• Local gates passed: npm run lint, npm run build, npm test, npm run docs:build, npm run compat:check, npm audit, cargo audit, and npm run supply-chain:install-scripts.
• Release workflow dry-run passed before publishing.
• Release workflow builds prebuilt native artifacts, verifies clean install rendering on supported runners, publishes with npm provenance, and checks provenance visibility.

Compatibility

• No intentional public API breaking changes in this patch release.
• This supersedes the aborted v0.1.1 publish attempt; use 0.1.2.

v0.1.0

v0.1.0

First non-alpha 0.x release for vellora's documented HTML-to-PDF subset.

This release keeps the project explicitly pre-1.0, but removes the alpha tag for the current
production-oriented surface: native in-process rendering, strict subset validation, dev-time lint/fix,
CLI workflows, batch/stream helpers, PDF/A-2b, images/fonts, and the optional environment-Chromium
fidelity engine.

Evidence

• CI passed on macOS and Ubuntu for the release commit.
• Resource Benchmarks passed on pinned Linux CI and are linked from the README.
• Release dry-run passed on all current build targets: darwin-arm64, darwin-x64, linux-x64-gnu, and
  linux-arm64-gnu.
• Clean-install verification rendered a PDF without a Rust toolchain on darwin-arm64,
  linux-x64-gnu, and linux-arm64-gnu.
• COMPATIBILITY.md was verified current with npm run compat:check.

Notes

• vellora is still not a browser clone; it targets generated document HTML inside a documented subset.
• The default vellora package does not bundle Chromium.
• @vellora/engine-chromium remains an explicit opt-in path that uses a host/environment-provided
  Chrome or Chromium executable.

v0.1.0-alpha.4

Alpha release with the optional Chromium fidelity engine.

Highlights:

• Add @vellora/engine-chromium as an opt-in Chromium-backed renderer.
• Add explicit reference-vs-subject fidelity checks to vellora doctor, including local Puppeteer PDF comparison support.
• Centralize fidelity policy parsing and include the Chromium engine package in the release pipeline.
• Remove internal docs/superpowers material from the public docs tree.

v0.1.0-alpha.3

Alpha.3 — custom fonts and authoring tools.

Highlights:

• Custom fonts are now live. Pass raw TTF/OTF bytes through the fonts option and reference each face from CSS by its intrinsic embedded family name.
• Font rendering stays deterministic: no host/system font lookup, no network or filesystem fetches from document content, and unreferenced custom faces leave output unchanged.
• Invalid font inputs now fail explicitly: non-Uint8Array entries reject with VelloraInputError, and unparseable font bytes reject with a located font:invalid diagnostic.
• @vellora/lint now exposes the public diagnose() / fix() API for dev-time template checks and deterministic codemods.
• @vellora/cli now includes vellora render, vellora lint, and vellora fix, including JSON lint output and fix --write.

Breaking alpha change:

• The fonts option was previously accepted but inert. It is now active and validates entries as Uint8Array[] font bytes.

Install:

npm install vellora
npm install -g @vellora/cli

See #9 and #10.

v0.1.0-alpha.2

Image source resolution. <img src> now resolves from the (previously inert) images and baseUrl render options.

• images: a Record<string, Uint8Array> mapping an <img>'s src to raw bytes; the format (PNG/JPEG/GIF/WebP) is detected from the bytes.
• baseUrl: normalizes a relative src into the images lookup key. No network or filesystem I/O on the render path — determinism is preserved.
• Inline data: URLs continue to render.

BREAKING: a renderable <img> whose src cannot be resolved (missing images entry, remote/unknown-scheme URL, unsupported/malformed data: URL, or unrecognized bytes) now rejects with a located image:unresolved diagnostic instead of rendering blank. A src-less or empty src is skipped silently.

See #7.

vellora 0.1.0-alpha.1

Alpha.1 — document rendering quality.

Highlights:

• Preserve anonymous inline text beside block-flow children (table-cell labels/values, boleto barcode text).
• Emit CSS backgrounds and borders into the PDF (table headers, zebra rows, field grids, separators).
• Correct collapsed-table inline insets and use a constant text-baseline compensation.
• Place fixed-table rowspan continuation cells in the correct column (boleto field grid).
• Preserve top-level fragment spacing during pagination.

Install: npm install vellora

vellora 0.1.0-alpha.0

First public alpha of vellora — render document HTML to PDF in Node.js in-process, with no browser (no Chromium, Puppeteer, wkhtmltopdf, or subprocess).

What's in this release

• Prebuilt native addon for darwin-arm64, darwin-x64, linux-x64-gnu, linux-arm64-gnu, and linux-x64-musl — npm install vellora produces a PDF on a clean host with no Rust toolchain.
• Deterministic output: same input → byte-identical PDF. No wall-clock, no system-font fallback; DejaVu Sans is embedded for portable, reproducible rendering (runs on slim/Alpine/Lambda images).
• APIs: renderPdf, renderPdfToStream, and a small templating layer (renderTemplate — {{var}}, {% for/if %}, currency/date/number helpers).
• Published with npm provenance.

Alpha caveats

• Pre-release / in active development — APIs may change.
• The fonts, images, and baseUrl options are accepted but currently inert (only metadata affects output).
• Windows is not supported yet (planned fast-follow).
• @vellora/lint is an early stub.

Install

npm install vellora@0.1.0-alpha.0

Docs: https://diomalta.github.io/vellora/ · Compatibility and roadmap are in the README.