v0.4.0 — Architecture Overhaul

What's New

Major architectural overhaul addressing the v0.3.1 design review.

⚠️ Breaking Changes

• v0.3.x encrypted files cannot be decrypted by v0.4.0. Users must re-lock their files. No backwards compatibility.
• `pagevault info` and `pagevault check` removed — replaced by `pagevault inspect` (with optional `--check`).
• `pagevault serve` removed — replaced by `pagevault dev serve`.
• Removed Python API aliases: `encrypt_html`, `decrypt_html`, `wrap_elements_for_encryption`, `wrap_body_for_encryption`. Use `lock_html`, `unlock_html`, `mark_elements`, `mark_body`.

Highlights

Runtime extraction

All browser-side JavaScript now lives in real .js files under `src/pagevault/runtime/`, loaded via `importlib.resources`. No more JS-inside-Python-f-strings — major readability win.

• `runtime/core/` — escape, crypto, chunks, storage, progress, activation
• `runtime/region/handler.js` — region encryption handler
• `runtime/wrap/` — file/site renderers + nav injector + ZIP shim
• Viewer JS in `src/pagevault/js/viewers/` (one .js + .css per viewer plugin)

Unified v4 envelope format

Replaced v2 (attribute-embedded) and v3 (chunked) with a single v4 chunked format used everywhere:

• Region encryption stores meta + chunks as `<script>` children inside `` (no more giant `data-encrypted=` attribute)
• File and site wrapping use the same envelope
• One encrypt path (`encrypt_v4`), one decrypt path (`decrypt_v4`)
• See `docs/v4-envelope.md` for spec

CLI split

`cli.py` (2155 lines) split into `cli/init.py` (49 lines) + `cli/shared.py` + `cli/commands/*.py` (one file per command). Easier to navigate, easier to test.

Renderer fixes

• #2 listener leak: `window.addEventListener('message', ...)` in site renderer now attached at module scope; no duplicate listeners on repeated renders.
• #5 overbroad regex: removed the quoted-file-path rewrite pass that could corrupt JS string literals. Use `fetch()` (handled by the fetch shim) for dynamic resource references.

Node-based JS unit tests

New `tests/js/` directory runs the browser runtime's crypto primitives under Node 20+ using built-in `node:test` + `node:vm`. No npm dependencies. Run: `node --test "tests/js/**/*.mjs"`.

Codebase shrinkage

• `wrap.py`: 1321 → 573 lines (-56%)
• `cli.py`: 2155 lines → `cli/init.py` 49 lines + 8 command modules
• Net deletion of ~1000 lines of inline JS-in-Python-strings

Tests

• 708 Python tests pass
• 12 Playwright browser tests pass
• 5 Node JS unit tests pass

Upgrade

```bash
pip install --upgrade pagevault
```

If you have v0.3.x encrypted files, you'll need to re-lock them with v0.4.0.