softschema 0.3.0

softschema 0.3.0 is a focused hard-cut release that gives the Python/Pydantic and TypeScript/Zod packages one bounded portable value model, safer offline validation, a smaller public API, and a checksum-verified shared release path.

What's Changed

Breaking changes

• Compilation identity is explicit: Python compile_model now requires contract_id; TypeScript compileSchema requires contractId. An optional schema_id / schemaId separately names the JSON Schema resource.
• Public library surface is smaller: Canonicalization, enforcement transforms, JSON presentation and hashing helpers, raw frontmatter parsing, engine-error normalization, generated-section parsing, SOFTSCHEMA_FORMAT_VERSION, and metadata internals are no longer package-root exports.
• Portable YAML is enforced at the boundary: Inputs are limited to bounded JSON-compatible values. Timestamps, aliases, anchors, merge keys, explicit tags, duplicate or non-string keys, unsafe integers, negative zero, non-finite numbers, excessive depth, and oversized inputs are rejected.
• Validation results have an explicit outcome: Artifact results include outcome: valid | invalid | input_error. Cross-runtime machine JSON promises structural equality rather than byte-identical pretty-printing.
• Skill installation is explicit: skill --install requires --scope project|personal and one or more --agent portable|claude targets; ambiguous invocations fail without writing.

Features

• Offline structural validation: Both implementations use explicit already-loaded schema resources and never retrieve remote $ref targets implicitly.
• Portable schema identity: Canonical schema digests preserve semantic annotations, use shared key and number rules, and keep logical contract identity separate from optional JSON Schema resource identity.
• Safer schema navigation and local loading: SchemaView preserves $ref siblings and exposes contract and schema IDs separately; document-bound schema paths and TypeScript model paths receive consistent containment and URL handling.
• Installed docs and skills: Both packages resolve bundled resources from the installed package rather than allowing a consumer checkout to shadow them.

Fixes and hardening

• Portable parsing parity: Python and TypeScript now agree on frontmatter delimiters, timestamp-shaped scalars, collection-depth limits, large-number handling, and stable input-error classifications.
• Schema validation parity: Regular expressions and patternProperties keys are checked eagerly against the portable subset; malformed schemas return stable structured failures.
• Enforced-object behavior: Strict-extra overlays reject unsupported composed-schema shapes instead of silently changing their meaning.
• Skill writes: Installation requires explicit scope and targets, supports --dry-run, refuses unmarked files, and atomically refreshes managed files using the compact format=f02 marker without a source digest.

Guidelines and content

• Agent bootstrap guidance: One-shot uvx and npx examples use softschema@latest; repeatable project and CI use is documented as a lockfile-backed dependency.
• Specification and guides: The shipped spec, guide, installation notes, language designs, examples, and skill now describe the same hard-cut API, trust model, portable YAML domain, and structural parity contract.

Testing and release safety

• Python lint and type checks plus 165 tests pass across Python 3.11–3.14.
• TypeScript lint, typecheck, 166 tests, and the coverage gate pass; Python, Node, and Bun golden journeys plus 20 direct parity commands pass.
• Wheel, sdist, and npm candidates are built once, checksum-verified, installed outside the checkout, and smoke-tested on Linux, macOS, and Windows at both supported runtime endpoints.
• Publication uses SHA-pinned actions and protected OIDC jobs that publish the exact tested candidates to PyPI and npm.

Full commit history: v0.2.2...v0.3.0